Intel Working On Open-Sourcing The FSP - Would Be Huge Win For Coreboot & Security

[L_A_G]

I'm probably not the only one who was first exited to read this and then remembered that the FSP is a separate system from the ME, i.e the thing that has been worrying security conscious people with it's combination being able to bypass an incredible number of security measures and how it's basically a complete black box.

[uid313]

Great news, this pleases me very much to hear!
I surely hope that AMD matches that commitment and does the same!

I currently own a Intel 4770K "Haswell" and have been disappointed by Intel because there have been very little progress over the generations. Kaby Lake, Kaby Lake Refresh, Coffee Lake, etc, its all just been very boring. Also the Spectre/Meltdown vulnerabilities have been a disenchanting mess.

At the same time, AMD have been introducing the Ryzen and Ryzen 2 which are very interesting. So AMD looks very promising.
Which have lead me into thinking that my next system will be one based on AMD. However, if Intel open sources their FSP then I will probably stay with Intel. Especially if AMD doesn't open source their FSP and if there will be better support for coreboot from Intel.

[lu_tze]

AMD didn't open their PSP code. I'm pretty pessimistic about Intel opening their FSP code. Wait'n'see.

FSP is equivalent to AGESA, not PSP. Equivalent to PSP would be ME.

Also, the customer interest is going from an improbable angle: cloud and datacenter operators. Those companies are interested in having their own firmware and bootloaders (Facebook had talks about this topic in many linux conferences for years), so Intel is in perfect spot for applying pressure: yeah, we like your Xeons, but we need this or that, otherwise those Epycs look nice too.

[avph]

Coreboot does not need open source Intel FSP or AMD AGESA, but proper documentation and/or well designed native code...

[c117152]

Would an open source FSP allow core/libreboot developers to create firmware that initializes the processor without turning on the ME?

Considering me_cleaner can only turn it off after it initializes the UEFI, I'm guessing the ME is fused read-only on the CPU and only has a little RW space to keep track of FSP versions to prevent rollback attacks and to store patches that it applies live to its memory every time it boots.

So, even if Intel open sources the FSP and the ME, we won't have a way to prevent the ME from initializing. Only a way to turn it off and hope it's really what it's doing and that it doesn't have an undocumented API Intel keeps off the open source that turns it back on.

[Ikaris]

AMD didn't open their PSP code. I'm pretty pessimistic about Intel opening their FSP code. Wait'n'see.

[M@yeulC]

Would part of the Linux kernel be able to run on the ME? I've been thinking about HSA and how Linux could support heterogeneous computing architectures. It would be nice to have it for a "deep-sleep" state, with only the ME running.

[Michael]

Would an open source FSP allow core/libreboot developers to create firmware that initializes the processor without turning on the ME?

Potentially. I tried asking him about ME implications but he was in process of leaving under time crunch so didn't get clear communication on ME or not.

[GreenByte]

Woah, that's some great news!

[Xicronic]

Would an open source FSP allow core/libreboot developers to create firmware that initializes the processor without turning on the ME?