Intel Working On Open-Sourcing The FSP - Would Be Huge Win For Coreboot & Security

[phoronix]

Phoronix: Intel Working On Open-Sourcing The FSP - Would Be Huge Win For Coreboot & Security

Intel's Architecture Day on Tuesday was delightfully filled with an overwhelming amount of valuable hardware information, but Intel's software efforts were also briefly touched on too. In fact, Raja Koduri reinforced how software is a big part of Intel technology and goes in-hand with their security, interconnect, memory, architecture, and process pillars and that's where their new oneAPI initiative will fit in. But what learning afterwards was most exciting on the software front...

http://www.phoronix.com/scan.php?page=news_item&px=Intel-Open-Source-FSP-Likely

[Xicronic]

Would an open source FSP allow core/libreboot developers to create firmware that initializes the processor without turning on the ME?

[GreenByte]

Woah, that's some great news!

[Michael]

Would an open source FSP allow core/libreboot developers to create firmware that initializes the processor without turning on the ME?

Potentially. I tried asking him about ME implications but he was in process of leaving under time crunch so didn't get clear communication on ME or not.

[M@yeulC]

Would part of the Linux kernel be able to run on the ME? I've been thinking about HSA and how Linux could support heterogeneous computing architectures. It would be nice to have it for a "deep-sleep" state, with only the ME running.

[Ikaris]

AMD didn't open their PSP code. I'm pretty pessimistic about Intel opening their FSP code. Wait'n'see.

[c117152]

Would an open source FSP allow core/libreboot developers to create firmware that initializes the processor without turning on the ME?

Considering me_cleaner can only turn it off after it initializes the UEFI, I'm guessing the ME is fused read-only on the CPU and only has a little RW space to keep track of FSP versions to prevent rollback attacks and to store patches that it applies live to its memory every time it boots.

So, even if Intel open sources the FSP and the ME, we won't have a way to prevent the ME from initializing. Only a way to turn it off and hope it's really what it's doing and that it doesn't have an undocumented API Intel keeps off the open source that turns it back on.

[avph]

Coreboot does not need open source Intel FSP or AMD AGESA, but proper documentation and/or well designed native code...

[lu_tze]

AMD didn't open their PSP code. I'm pretty pessimistic about Intel opening their FSP code. Wait'n'see.

FSP is equivalent to AGESA, not PSP. Equivalent to PSP would be ME.

Also, the customer interest is going from an improbable angle: cloud and datacenter operators. Those companies are interested in having their own firmware and bootloaders (Facebook had talks about this topic in many linux conferences for years), so Intel is in perfect spot for applying pressure: yeah, we like your Xeons, but we need this or that, otherwise those Epycs look nice too.

[uid313]

Great news, this pleases me very much to hear!
I surely hope that AMD matches that commitment and does the same!

I currently own a Intel 4770K "Haswell" and have been disappointed by Intel because there have been very little progress over the generations. Kaby Lake, Kaby Lake Refresh, Coffee Lake, etc, its all just been very boring. Also the Spectre/Meltdown vulnerabilities have been a disenchanting mess.

At the same time, AMD have been introducing the Ryzen and Ryzen 2 which are very interesting. So AMD looks very promising.
Which have lead me into thinking that my next system will be one based on AMD. However, if Intel open sources their FSP then I will probably stay with Intel. Especially if AMD doesn't open source their FSP and if there will be better support for coreboot from Intel.