https://www.phoronix.com/scan.php?page=news_item&px=Purism-Librem-Still-Blobbed
"Even with the Librem 13 they're working on right now, they still haven't
been able to make a firm commitment for a fully-free BIOS. I was sent an
interesting email this weekend exposing more details of Librem. The text was
interesting in its own right so it's been as the rest of this article. The
original author wishes to remain anonymous.
###
Todd Weaver (who has employees at Purism now since February, including Jacob
Appelbaum) is not only misleading/scamming his crowdfunding backers and the
public with "Librem" laptops that aren't, but also harming the free software
community at large with his actions.
Todd promotes his Librem 15 as "the first high-end laptop in the world that
ships" with a fully free operating system and touts this as a "HUGE win" –
obviously this is false, as ThinkPenguin and Los Alamos Computers have been
installing Trisquel on high-end laptops for years before Purism existed.
In his November blog posts he claimed with strange diagrams that the BIOS was
already two-thirds freed. On the Crowd Supply page he makes conflicting and
confusing statements, first saying that "the BIOS does use coreboot" and then
saying that "the BIOS is not yet free" but "the Librem 15 will be the first
laptop ever manufactured to ship with a modern Intel CPU fused to run
unsigned BIOS code". This is followed by a quote from Richard Stallman which
suggests that Richard Stallman, speaking on behalf of the FSF, endorse
Purism's work.
This inaccurate statement about the Librem 15 is a confusing reference to
Intel Boot Guard as well a suggestion that Purism has led "pioneering
efforts" and discovered something revolutionary. In reality, Boot Guard is
only a "feature" on Haswell (fourth-generation Intel Core) and later CPUs, so
in the past all laptops with a "modern Intel CPU" could "run unsigned BIOS
code". And frankly, anyone who's built a PC and is vaguely familiar with Boot
Guard could figure out how to avoid it – any CPU that is sold separately
from the mainboard and BIOS can't be fused by the mainboard vendor to run
only their BIOS.
So, considering Todd's statements about the BIOS being two-thirds freed and
using coreboot and about the CPU being "fused to run unsigned BIOS code", one
might easily be led to believe that Purism is shipping their laptops with
fused CPUs and coreboot. However, an owner of a Librem 15 rev1 reported that
the unit came with "American Megatrends version 2.15.1236".
This seems to be confirmed on Todd's "BIOS Freedom Status" post, which now
since December lists "Release a coreboot/libreboot for the Librem 15" after
"Reverse engineer, or release the FSP source" (which sometime in March or so
became "Free the FSP/ME"). Todd has said that he's in contact with Sage
Electronic Engineering (a company that develops coreboot-based board support
packages with non-free firmware for Intel and AMD systems) about porting
coreboot to his laptops, which may very well be true.
But apparently he plans to get coreboot running on his laptops after he frees
the Intel Firmware Support Package (FSP, a binary firmware package that
performs initialization of the memory controller and other hardware, which
Intel distributes to boot firmware developers) and Management Engine (ME, an
embedded coprocessor with DMA and firmware on which applications like the
Trusted Platform Module, Boot Guard, Active Management Technology, and
audio/video DRM run). In other words, the Librem laptops might never ship
with coreboot.
Regarding the FSP, Todd says that Purism is "working with Intel to allow
[Purism] to scrub, release, and maintain the source for the FSP, but [Purism
hasn't] finalized that yet." He also says that someone from Intel at IDF14
"suggested that [Intel] might be willing to share some of the needed
information" to somehow free the FSP per his BIOS Freedom Status blog post.
Since Google and others have tried to get Intel to publish code or
documentation for hardware intialization, and all Google managed to get out
of Intel was a Memory Reference Code (MRC) blob for Sandy Bridge and Ivy
Bridge, I suspect that his only contact with Intel was with a salesperson at
IDF14 who told him everything he wanted to hear about all of the
documentation Intel could provide to Purism under Intel's Corporate NDAs. I'd
like to hear more from Todd about who his Intel contact is and what they've
said they might share.
If Intel refuses to free the FSP, there is another option: reverse engineer
its contents, study documentation (under Corporate NDAs), and develop
replacement code. But that will take years of work by people with great
knowledge of DDR3 RAM controller initialization and training, among other
things.
To his credit, Todd at least seems to have some clue of what's in the FSP. It
sounds like he researched Intel and AMD systems and focused on these hardware
initialization blobs. Of course, he could have avoided the whole FSP issue
(as well as Boot Guard) by using Sandy Bridge (second-generation Intel Core)
or Ivy Bridge (third-generation Intel Core) hardware, for which native RAM
initialization code was developed by a skilled coreboot hacker who studied
the MRC blob.
This would (slightly) increase his odds of successfully building a free
system. He knows this and admits as much in the last paragraph of the "Intel
Management Engine (ME)" section of his "BIOS Freedom Status" post. But after
that statement, he says that the ME is still an issue. The paragraph
effectively says, "making a free system is already a hard problem, so we
might as well make it harder."
His plan to solve the ME problem shows less thought. Back in November, he
didn't even mention the ME, suggesting that either he didn't know about it at
all – perhaps thinking, as is common, that an Intel PCH (CPU and
northbridge) without the AMT application is completely free of such non-free
firmware – or he was trying to ignore the issue. In December he updated his
post to acknowledge the ME, proceed to discuss the FSP in what might be an
attempt to confuse the matters, then reveal his half-baked plan.
He said that ideally Purism would "load [their] own open source ARC firmware
that can initialize the clocks on the board. [Then another
confusing/distracting remark about the FSP.]" He then acknowledged that this
is, at the very least, "a very very difficult problem" because the ME
firmware is signed. So instead his plan is to "get that freed by Intel or
more likely their subcontractor BIOS development company [Purism has its] NDA
with."
Not only is Intel most likely unwilling to ever free the ME firmware code,
but they're also almost definitely unable to do so, because the ME firmware
is based on a ThreadX RTOS, a Java virtual machine, a Web server, and
probably lots of other proprietary third-party code that Intel can't just
release. It also runs "security" applications like for audio and video
decryption (DRM). And even if they did release it, the boot loader stored on
ARC core's ROM still won't load ME firmware that isn't signed by Intel. So
then you have the increasingly common "TiVo" issue of firmware you can modify
and build but not install and run.
On systems with Intel 4 Series chipsets running Intel ME firmware version
4.0, like the Lenovo ThinkPad X200, it was possible to remove the ME firmware
from the boot flash memory space and modify the ICH9 (southbridge) flash
descriptor to disable the ME core. On newer Intel systems this doesn't seem
possible, because the ME firmware is more integral to the system. According
to coreboot developers, newer ME firmware performs some hardware
initialization and power management, and the ME boot loader will shut down
the system after 30 minutes if ME firmware with a valid signature isn't
loaded.
Sometime around March, Todd removed from his post the sentence describing his
plan to get the ME freed by Intel or American Megatrends, which is also
rather suspicious. As far as I can tell, Todd's plan for the ME is doomed to
fail for multiple reasons, and it looks like he might now realize that.
Notably, the Crowd Supply campaign pages don't mention the ME at all –
neither making a false promise to free it nor even acknowledging it as a
problem.
More information about the ME is available in a book published by Apress, on
Wikipedia, and on reverse engineering web-sites.
Another issue with modern Intel CPUs is that their increasingly large
instruction sets are implemented in extremely complex microcode, and the
factory-installed microcode revisions are always buggy. For this reason,
Intel (and AMD) releases (non-free) microcode updates to be uploaded to the
CPU by the boot firmware. Since November, Todd has noted that the
factory-installed microcode on Librem laptops is unlikely to work.
He confirmed this four days ago in a post responding to Alex's criticism of
Purism. He says near the end of the post, "We hope that the FSF will grant
the hardware exemption for the CPU microcode, a non-free binary blob that is
cryptographically signed and locked down. The Librem 13 requires CPU
microcode loaded by coreboot during startup."
Additionally, Librem 15 prototypes included an "NVIDIA GT840M 3D controller",
which didn't even work with Nouveau, as can be seen in the Linux ring buffer
log that Todd posted (look for "nouveau": the driver says "unknown chipset,
0x118010a2"). Depending on whether this "GT840M" is a GeForce GTX 840M or a
GeForce 840M, it might be supported by Nouveau by now. Either way, this is a
new GM10x-family Maxwell-architecture GPU.
Nvidia GPUs have a "Falcon" processor which runs microcode for context
switching. This microcode is uploaded to the GPU by the graphics driver in
the host OS kernel. Nouveau developers have reverse engineered this non-free
microcode and replaced it with free microcode for many Nvidia GPUs. However,
the Falcon processor on new Maxwell GPUs will only run microcode signed by
Nvidia. Nouveau developers remain waiting on Nvidia to release signed
firmware images for Maxwell.
All of this suggests some combination of fraud and incompetence in Todd and
Purism. And like I said, not only does this serve to trick people into giving
their money and attention to a project that can't possibly deliver what it
promises, but it also harms the efforts and credibility of the free software
movement generally.
The FSF, ThinkPenguin, coreboot, libreboot, Replicant, Nouveau, Google's
Chrome OS team, and others have been working for years to enable hardware to
work with free software. We as a community have had some nice successes, and
we've also hit plenty of walls with Intel, AMD, Atheros, Broadcom, ARM,
Nvidia, and other uncooperative hardware vendors. We know that freeing
software and firmware to make mostly or fully free systems is hard and that
fully free modern Intel systems are basically impossible.
But Todd swoops in, raises at least half a million dollars, and convinces
lots of people that free systems with modern Intel hardware are not only
possible but forthcoming. I imagine real efforts to make free systems will be
met with more criticism than ever (or skepticism among anyone who realizes
that Purism can't fulfill their promises). We'll have older Intel systems,
AMD boards, low-power ARM laptops, etc. But Todd will have people expecting
"fully free" to be "new and shiny high-end Intel laptops". And anyone who
honestly sells mostly free systems, like ThinkPenguin does, could eventually
be seen by some people as not doing enough for free software, while Purism
sells systems that are no more free but are thought to be completely "libre".
The Librem 13 campaign page even says that Purism plans to produce a Librem
Tablet followed by a Librem Phone. I expect more self-defeating decisions in
those projects, if they happen, especially considering mobile computers have
many of the same problems that modern PCs have, and more (non-free and signed
boot loader stacks, non-free drivers and firmware for radios, backdoored
baseband processors, etc.)."
