Qubes-Community-Content/docs/hardware-selection.md
2018-03-22 08:08:55 +02:00

4.7 KiB

Hardware Selection Tree

Selecting the appropriate hardware for Qubes R4.0 can be a complex choice. This document aims to simplify that. Click on the links, read the supporting information if desired, reach a conclusion.

Note Qubes does not endorse any of the manufacturers or methods listed.

Start here

Are you concerned about potential manufacturer hardware backdoors?

Yes
No

Concerned

Are you concerned about blobs being used to initialize hardware?

Yes
No
No, but I want AMD

Init

Nearly all R4.0 capable systems require at least a CPU microcode blob, and often one for video BIOS. However, there are still some options when it comes to running the proprietary, unaudited code for hardware initialization. Do you want:

AMD
Intel

AMD

If you don't mind older/used hardware, there are some options if you do not want PSP initialization. All new AMD hardware comes with PSP. In theory there is an option to partially disable it, but no motherboard/BIOS manufacturers have made it available yet.

Form factor?

Laptop
Desktop

AMD Laptop

DIY corebooted used Lenovo G505s with microcode patch.

AMD Desktop

DIY or commercially available corebooted (or librebooted?) KCMA-D8/KGPE-D16. Vikings is one vendor that appears to sell these. If used with Opteron Series 2 processors, no microcode blob is required.

Intel

Unfortunately, all R4.0 capable Intel hardware requires use of at least the BUP portion of Intel ME. Weaknesses have been found in this proprietary, non-owner-controlled code. There are some ways to restrict Intel ME after the initial BUP.

Commercial
DIY

Intel Commercial

These vendors have systems available that partially disable Intel ME after the initial hardware initialization: System76, Purism, Dell. Implementations vary, so research the vendors. Prefer ones that use Coreboot instead of closed-source, proprietary UEFI firmware. Search the HCL for a compatible system. Search the mailing list for additional reports.

Intel DIY

Closed-source, proprietary UEFI firmware has its own set of vulnerabilities. Do these concern you?

Yes
No

Coreboot

Cross reference Coreboot capable systems with the HCL. See also the board freedom index. Search the mailing list for additional reports. Flash your system with Coreboot, including ME_Cleaner.

MECleaner

Search the HCL for a compatible system. Search the mailing list for additional reports. Follow the instructions here to partially disable Intel ME.

Unconcerned

Search the HCL for an R4.0 compatible system. Search the mailing list for additional reports. If selecting a desktop, you may also want to include and use a third party NIC in an expansion slot instead of the onboard Ethernet. This will help avoid overt network communications from onboard management. This is often not an option in laptops with manufacturer firmware due to the use of NIC whitelists.