Short list of laptops/desktops that work well with Qubes OS

Would the minimized requirement not also disqualify the Librem?

I know they can disable ME using HAP, but can they actually clean ME on the Librem?

3 Likes

@renehoj sounds like they do both: minimize and disable …

While finishing our first coreboot port, we have successfully neutralized (zeroed-out) a very significant portion of the Intel ME, thanks to the great work of the “me_cleaner” project. By doing so, we remove the Intel ME’s kernel, network stack, and about 90-92% of the Intel ME binary in total (this figure varies across ME versions).

I assumed the Librem 14 would be the 10th gen CPU, their documentation is about using me_cleaner on 6th gen skylake.

I don’t think it works anymore, you can only use HAP on the new CPUs.

2 Likes

See the page dedicated to Librem 14:

No, it’s not minimized. Earlier laptop models (including mine) were neutralized as explained in your ilnks, but not the new one.

2 Likes

As far as I know, here are laptops that still get microcode updates (6th gen and later [11]) + have coreboot:

Laptop CPU cores ME EC Qubes suspend
NovaCustom NS51, NS70 4 x Intel 11th ? ? ?
Purism Librem 13v4, 15v4 2 x Intel 7th minimizable [12] ? yes - see HCL
Purism Librem 14 6 x Intel 10th factory-disabled FOSS [5] yes [9]
Starlabs Mk VI 4+8 x Intel 12th ? ? ?
Starlabs Mk V 4 x Intel 11th factory-disabled proprietary [7] yes [8]
System76 darp8 4+8 x Intel 12th ? FOSS no? - 12th-gen
System76 galp5, lemp10 4 x Intel 11th user-disabled [2] FOSS [A] no [10]
System76 oryp7, lemp9 4-8 x Intel 10th ? FOSS [A] yes? - S3
System76 galp3, galp3b 4 x Intel 8th factory-minimized? [4] proprietary? [A][B] yes? - S3

Note: Intel 11th-gen onwards dropped support for S3 sleep, replacing it with s0ix, which is not currently working in qubes.[1] Though certain Intel 11th-gen CPUs have working S3.[3]

[1]https://github.com/QubesOS/qubes-issues/issues/6411
[2]WIP: disable ME on galp5 and lemp10 · system76/firmware-open@f8c3962 · GitHub
[3]https://www.reddit.com/r/System76/comments/o19ew4/starlabs_better_than_system76_tuxedo_and_starlabs/
[4]while upstream coreboot has option to run MECleaner on these boards, Bootguard may prevent modification. Is vendor-signed firmware, ME-minimized?
[5]Librem-EC on Purism Devices – Purism
[6]Previous Models - System76 Technical Documentation
[7]Star Labs (@starlabsltd): "We appreciate the supportive feedback and we certainly are Ryker! We are looking to make this available over the next couple of months. The best suggestion we can make is to sign up to our newsletter as this will be the first place any details relating to this will be released 🙂"|nitter
[8]HCL - Star Labs MK V
[9]Hardware compatibility list (HCL) | Qubes OS
[10]https://github.com/system76/firmware-open/issues/151
[11]https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/blob/main/releasenote.md#microcode-20220510
[12]Coreboot Firmware on Purism Librem Devices – Purism
[A]System76 open boot firmware / EC list: System76 Open Firmware Models - System76 Support
[B]System76 ec boards: ec/src/board/system76 at 60dfb62f90e039c9aa73eb15d71a56b4d00a02d5 · system76/ec · GitHub

3 Likes