Recommended BIOS setting for Intel platform

Genode and Sculpt OS
1

Hello,

I guess it could be a noob question but I’m indeed not very knowledgeable here and I haven’t seen any doc on that.

Bear with me,
I know that there are requirements listed on the Sculpt OS page, those are simple, but my question is more about recommendations on all the fancy words I see in my BIOS.

I have these set already on my PC, no worries, not a sloppy reader here

  • VT-d enabled
  • VT-x enabled (aka Intel (VMX) Virtualization, aka Intel Virtualization Technology)
  • Boot from USB enabled
  • UEFI boot enabled
  • UEFI secure boot disabled

And since we are talking about secure OS I’d like to have some recommendations for the following settings in my BIOS (probably common to all Intel-s) for both Nova and HW kernels.
In particular from stability and security view point for Sculpt OS.

Of course each BIOS has it’s own layout and it’s impossible to have a common map for all, but there’s a number of features that are kinda mystery in terms of security and reliability.

TPM Device Selection (aka Trusted Computing).
What is safer: to disable or enable it? What is better for stability?
Sometimes it has additional setting for ME Operation Mode (that’s kinda a backdoor from Intel, rght?)

APM (Advanced Power Management)
Looks like directly connected with the sleep/standby features. I wonder if this is relevant to the Sculpt OS?

  • CEC Ready
  • Energy Star Ready
  • ErP Ready

ASPM (Active State Power Management)
These are confusingly spread over different submenus and for different subsystems (PCH - PCI Express, SA - PCI Express) and include these options (not sure all are connected to it though)

  • Native ASMP (aka PCI Express Native Power Management?)
  • DMI Link ASPM Control
  • PCH DMI ASPM
  • ASPM
  • L1 Substates
  • PCI Express Clock Gating
  • PEG - ASPM

CPU Configurations
These I believe very important and have direct impact on the system security, stability and performance

  • Software Guard Extensions (SGX)
  • Tcc Offset Time Window
  • Hardware Prefetcher
  • Adjacent Cache Line Prefetch
  • Hyper-Threading (I heard it’s safer to disable it to avoid side-channel attacks?)
  • MonitorMWait

CPU Power
These I believe very important and have direct impact on the system, stability and performance

  • Intel(R) SpeedStep™
  • Intel(R) Speed Shift Technology
  • Intel(R) Turbo Boost Max Technology 3.0
    • Runtime SMM Polling
    • Turbo Mode
  • CPU C-States
  • Dual Tau Boost
  • CFG Lock

PCH Storage
This I believe this is specific to the storage devices and I wonder if these are relevant to or supported by SculptOS? And how do they affect the stability/performance?

  • Aggressive LPM Support
  • SATA Hot Plug

Overall I feel it would be really helpful to have kinda a cheat sheet for BIOS settings with their relevance for Sculpt OC (Nova and HW) and recommendations for each feature.

I spent a couple hours trying to figure that out with AI agents, but looks that practical security/stability info is so scared and scattered that it can’t give reliable suggestions.
And when trying to apply it to Sculpt OS it just hallucinates without making much sense.

1 Like
2

One thing I may have missed: Is the system actually booting at present?

If it works I would probably not worry too much. I generally feel there is no harm in having most optional features set to default (usually on) even though the OS probably won’t use them. Secure boot I think will prevent the computer from booting anything that’s not the installed windows, so you probably want that last box in the first list checked.

3

My systems?
Yeah they are booting and run ok.

My question more on security side here + stability tips.
If an app may break free exploiting one of those features without the Ring 0 access level then all the Genode isolation measures are useless.

E.g. I heard about side channel attacks that exploit physics and HT vulnerabilities on lower level than OS controls.
Same I heard about Intel ME device that is de-facto a PC inside a PC invisible to OS with it’s own network stack and sometimes even with a web server on board :exploding_head:

Maybe it’s more on the tin-foil-hat side, but still it would be useful to know how to prepare a solid hardware foundation for the SculptOS. So it will be actually the most security improvement possible rather than a shiny metal door on a cardboard walls and plastic hinges :sweat_smile:

4

I tend to put a lot of these things in the category of stuff that you will really have to be handling other people’s confidential data, or be otherwise a particularly high target for espionage, before having to worry about.

The other thought that occurred to me, and probably most important, is simply to ensure your firmware (BIOS) is the latest version.

5

I am by no means an expert, so take things with a pinch of salt. The best source of information on all of these settings is probably your motherboard manual or similar.

Disabling it might help protect against vulnerabilities in ME, but I believe that most of those require physical access, or require you to already be pwned anyway. It is vulnerable, and it is likely a backdoor, but it isn’t special in any way. Intel could have plenty of backdoors hard-coded into the silicon, or introduce them via microcode updates, and there is nothing that you can do about it, other than complain and/or stop using those products. If it is that much of concern to you, then we are lucky that Sculpt OS is able to run on other platforms than x86.

All are regulatory/compliance for power-management and I doubt will have much effect.

Purely anecdotal, but there were some stability issues with this on my motherboard and some PCIe devices, as they kept transitioning to d3cold states on Linux. Unless you are using a laptop, I would say that most LPM settings are not going to be that beneficial and will give you headaches in the long-run.

Creates a secure enclave similar to ARM TrustZone. Don’t think it had any non-server use-cases outside of DRM, and is now deprecated on newer chips.

As always, it depends on your threat model. Disabling it outright is “safer”, and this is the decision taken by other security-focused OSes such as Qubes and OpenBSD, but this doesn’t mean it’s necessary on Sculpt OS. You may be able to protect against certain side-channel attacks more easily on Sculpt OS, as you can choose the cores that each component can use, so you don’t have different security domains running on the same core. You may also want to look at this discussion on Genode’s response to the Spectre/Meltdown vulnerabilities here for some more info.

I personally use an AMD system so don’t have experience with this, but I have heard that due to Intel’s P & E core split, changes to Hyper-Threading can affect the activation of lower C-states.

I think that BIOS/UEFI options vary too much across manufacturers and generation to justify a universal checklist. Unless there is something that Sculpt OS explicitly needs to take advantage of, which can be activated via the BIOS (i.e. virtualisation), I don’t see it being that impactful to prematurely optimise everything, especially as BIOS settings don’t tend to deliver noticeable benefits anyway. That said, it is useful having standard “known-good” working settings for some debugging cases, especially where issues are only present due to BIOS tweaks or there are some settings that can fix platform-specific quirks (although most people just tend to call these the defaults :upside_down_face:). There are a few settings that I can think of (Fast Boot on some devices) that could cause problems with someone trying to run Sculpt OS, if they have been meddling with their BIOS a bit.

1 Like
6

@tickzip thank you a lot for a detailed answer!

This is true, the official docs will briefly explain what is what and sell it to a user:
HT: get 2x cores for free! without saying anything about security (Meltdown) tradeoffs.
Unfortunately vendors don’t give any security hints about features they sell. All a regular consumer see is only benefits, flowers and sunshine.
That’s why as a newbie in this topic I raised a security-wise question about all those features, to know if I’m putting a safe vault metal door on a thin plywood wall around it :sweat_smile:

Lurking around I actually found that it runs a minimal Minix system with it’s own network stack and even, not uncommon, a web server onboard! And it runs with the highest possible privilege :detective:
Effectively a nasty backdoor attack surface, that is impossible to mitigate from any OS installed.
Not sure if this is valid, but with some help from AI I found a way to starve it in privileges by disabling network stack in BIOS - supposedly it will cut off it’s access to the network, leaving it unreachable to remote attacks…

Thank you a lot!
Definitely a reading I’d like to take in context of Genode :folded_hands:

That’s an aha moment, thanks! :light_bulb:
Why haven’t I think about it in that way?
Need to explore if it’s possible to do this dynamically and temporary. Imagining a scenario where I want to deploy a potentially malicious component to explore and try it out, limiting it to only 1 physical core. But in a way that automatically prevents the whole system from using this core without redeploying everything with manual cores selection to explicitly exclude that one core :thinking:

After diving to the ME topic that was my thought of solution. But once again, how can I be sure that other architectures are free of such back doors or even worse vulnerabilities?
Mb known back-doors that have a way to deactivate them is better that yet unknown ones :sweat_smile:

Overall I feel that a user-friendly generic security guide specific to Genode/Sculpt OS is missing. Especially for majority of common vendors hardware “features” in consumer electronics. Though I understand that increasing users security literacy is out of this project scope. :ok_hand:

7

When you get down to the BIOS/firmware level, you are essentially dealing with the “root of trust”. If there is a flaw or a backdoor in the system, it is very unlikely that a toggle in the BIOS menu will properly mitigate it. IIRC the BIOS settings regarding network access are for PXE booting and have no effect on IME, which has its own network stack.

While BIOS tweaks and OS isolation provide layers of defence, it’s helpful to look at this through the lens of your own threat model. A low-level IME exploit is more like an ICBM. It is a state-level weapon, and if an adversary has the capability to launch a silicon-level “strike”, it doesn’t matter if you have a reinforced steel door or a cardboard one; the entire building is gone.

I’d gently suggest that this is an area where its easy to lean into FUD (fear, uncertainty, and doubt), and I would suggest looking at this thread on Privacy Guides which offers a more measured perspective, and provides some additional context on the Intel ME discussion. For an authoritative take on why the x86 platform is so fundamentally difficult to secure, check out this paper from the founder of Qubes OS.

I think that this xkcd sums up the irony of this specific type of over-engineering quite well.

1 Like
8

@tickzip thanks a lot for all those tips! It helps a lot! :folded_hands: