Librem 14's ME disabled but not neutralized

To be fair, we don’t know that the ME / PSP is a backdoor.

The failure to be fully satisfactory is that there is no way of knowing. It might be a backdoor. It might not be.

You can’t change the code that runs on the homunculus CPU.
You can’t fully disable it.
The homunculus CPU has all-powerful control over the main CPUs, completely bypassing the operating system.
It has network access.

(What’s not to hate? :wink:)

Whether it is a backdoor, I don’t know, but it has good attributes for being a backdoor even if it is not intentionally a backdoor.

Security flaws have been found in the homunculus CPU and that is a very dangerous place to have a security flaw.

4 Likes

Sorry but I’ve got another stupid question. What is a “homunculus” CPU ?

2 Likes

I would like to hear that to. There is a kind of figure, sculpture or statue in medicine. It map the size of parts of the body / organs to the size the corresponding organ takes in brain. Example: the lips are represented by relative big parts of the brain compared to other organs. So the lips of the homunculus sculpture are pretty big. This results in unordinary proportions of organs of the homunculus and the sculpture does look a bit scary. I don’t know where the word has its origin. Probably Greece or Latin.

Wikipedia says it means something like little human. Humanly / humanlet. They talk of an artificial human. It’s used in different contexts.

In relation to ME / PSP it is an interesting philosophical usage. An artificial little processor? Why do we need them if we already have processors (even if they are also artificial).

Opening paragraph of: https://en.wikipedia.org/wiki/Backdoor_(computing)

Intel’s ME and AMD’s PSP are both examples of a homunculus CPU.

A nasty little miniature CPU that is sucking the security life out of the main CPU.

Well that’s great. I can’t afford and wouldn’t spend the kind of money the Raptor Talos II commands unless I win Powerball or find a briefcase full of new $100 bills.
They are quite the machine though. Linus’s personal computer is pretty cool too. Little pricey but very cool.

maybe WE don’t need them, but we can ASSUME that since they are PURPOSEFULLY placed on the SAME die as the MAIN CPU then it has a PURPOSE (it could serve an active function or it might be that it’s simply dormant)… what that purpose is EXACTLY ? we do NOT know as Kieran said above.

but we would like to KNOW … sadly, without a signed NDA …

Good question. I’ve never seen a fully coherent explanation of why the homunculus CPU exists.

I think Intel/AMD would in part argue that they want to offer the functionality of being able to reset / power up / power down / diagnose the main CPUs regardless of the state of same - but that is functionality that personal computers don’t need. That is primarily “lights out” server room functionality.

I would be happy if Intel Xeon CPUs had that functionality and no other Intel CPUs had it.

Regardless, it would be better if the homunculus CPU could execute vanilla x86 code supplied by the owner of the computer i.e. no different than the main CPUs. Then it could be verified. It would be auditable. It would be transparent. And it could of course be guaranteed halted if you don’t need its functionality.

Just a thought: what, if all x86_64 software will run in virtual machines inside the main system on a POWER9 processor? Will this work?

qemu-system-x86_64 works in the Raptor according to posts on the forum.
Too bad that IBM’s POWER10 will use a Synopsys DDR PHY which requires a proprietary firmware to set the DDR timing.

2 Likes

Primarily this. And yes there are commercial environments where companies want to control computers in this way. Being able to remotely make changes to the BIOS is something I’ve not seen offered any other way.

Most of the companies that want this want it not just in workstation class systems but also lower spec’s hardware. There is no meaningful incentive for Intel to make a separate line of products just to not include this functionality. Charge more for it and don’t provide an alternative and only have to support it for a fraction of customers… That’s basically printing money.

While you or I may not want to be controlled by the companies we work for, companies asking for more control of the hardware they’re buying seems like a coherent enough argument to me.

This functionality changing locations and what parts are safe to zero out in newer hardware isn’t surprising either as designs change and functionality is added/removed.

2 Likes

exactly ! this is more a market problem rather … we need more people interested in RISCV and open-hw projects …