Intel graphic card firmware updates broken due to Intel ME kernel modules disabling in Qubes #9369
Description
Qubes OS release
R4.1
Brief summary
Intel graphics card firmware updates likely broken by Qubes.
Steps to reproduce
Unknown.
Expected behavior
Intel graphics card firmware update should be functional or at least likely functional.
Actual behavior
Intel graphics card firmware update unknown if functional and likely broken by Qubes.
Technical explanation
#3916 and Qubes kernel config show Intel ME related kernel modules as disabled / not compiled in.
Here is quote about the mei-gsc kernel module from https://cateee.net/lkddb/web-lkddb/INTEL_MEI_GSC.html
An MEI device here called GSC can be embedded in an Intel graphics devices, to support a range of chassis tasks such as graphics card firmware update and security tasks.
This means by messing with Intel ME kernel modules, Qubes might break the Intel graphic card firmware update mechanism (which I did not look up yet how that works).
The existence of https://github.com/3mdeb/qubes-fwupd and #8813 implies that Qubes wants to support firmware updates from Qubes dom0.
Security enthusiasts, myself included, don't like Intel ME, a whole operating system running inside the CPU because it is a security risk. Therefore it might be tempting to put a big hammer on anything Intel ME related such as Intel ME kernel modules for activist reasons. These reasons however might not be sound security practices. Qubes also installs Intel / AMD microcode by default, which is proprietary, and where one also needs to blindly hope everything will be OK.
Note, that Intel ME kernel module disabling does nothing about Intel ME running directly inside the CPU.
Therefore, unfortunately, it must be reconsidered if disabling Intel ME kernel modules in Qubes is a good idea as kernel documentation implies that not using that module makes Intel graphic card firmware updates impossible.