It's Now Possible To Disable & Strip Down Intel's ME Blob

[zboson]

Are you seriously asking this? You think Intel made the ME to let people disable it at will?

Intel does not implement UEFI or BIOS on most motherboards (though I think it does with the NUC). What's stopping a board manufacture such as ASUS from adding this as an advanced option in their BIOS/UEFI?

[Tomin]

Are there any side-effects to disabling Intel ME, does anything useful stop working?

It seems that sometimes the network card doesn't wake up on cold boot if ME it's initialization code is removed. I don't know if this applies only to Linux and anyway it will work after reboot.

My laptop doesn't have ethernet, but I still would like to get suitable flasher (and take a backup) before I mess with this one... There are some annoying things in the firmware, so it would be really cool to switch to Coreboot. Too bad this laptop is not supported.

Oh, and you should also read the end of this page (title: Cool, how can I apply it?): https://github.com/corna/me_cleaner/...oes-it-work%3F

Edit again: Well, it actually contradicts some of the things I said and I realized that I'd need the flasher anyway to actually flash the firmware. Flashrom doesn't support my board (and many other laptops).

[starshipeleven]

It is silly how difficult it is to disable this Intel Management Engine (ME). I wish there was just an option in the UEFI setup screen to disable this feature.
Why isn't there?

Are you seriously asking this? You think Intel made the ME to let people disable it at will?

Is it possible to restore this functionality once disabled with this Python script?

Reflash the board firmware.

Are there any side-effects to disabling Intel ME, does anything useful stop working?

Stuff connected to DRM systems stops working, the rest is unknown, but probably a "no"

[cj.wijtmans]

It is silly how difficult it is to disable this Intel Management Engine (ME). I wish there was just an option in the UEFI setup screen to disable this feature.
Why isn't there?

Is it possible to restore this functionality once disabled with this Python script?
Are there any side-effects to disabling Intel ME, does anything useful stop working?

I think mine has the option if i remember correctly. But you cant trust it really. Also it can flash ME alongside with the BIOS.

[uid313]

It is silly how difficult it is to disable this Intel Management Engine (ME). I wish there was just an option in the UEFI setup screen to disable this feature.
Why isn't there?

Is it possible to restore this functionality once disabled with this Python script?
Are there any side-effects to disabling Intel ME, does anything useful stop working?

[starshipeleven]

Is there any way to restore full ME in-case issues arise (aside from hardware SPI chip restore)?

I'd say no as fuckign with board firmware in general might brick the board completely (no boot at all).
Buy a SPI flasher, nowadays there are dirt cheap ones (CH341A) supported by Flashrom.

And do tools that interact with ME firmware still work?

I'd say also no, as it removes pretty much everything that is not hardware initialization, see above.

EDIT: confirmed, tools interacting with ME don't work, and MEI disappears form lspci https://github.com/corna/me_cleaner/issues/3

[starshipeleven]

The website gives that impression. Only some of the modules are currently removed, and it depends on exactly what ME version you're dealing with.

https://github.com/corna/me_cleaner/...oes-it-work%3F After a while I updated me_cleaner to remove also most of the Huffman-compressed modules, leaving only:

• ROMP (not always present)
• BUP - Bringup (hardware initialization/configuration)

while all this stuff gets nuked

• KERNEL - Scheduler, low-level APIs for other modules
• POLICY - Secondary init tasks, some high-level APIs
• FTCS
• The network stack (partition NFTP)
• The PAVP (partition MDMV, module JCOM) (pavp = protected audio and video path = drm stuff)

All in all, I wouldn't say it's too bad.

My Ivy Bridge workstation has a socketed chip and I also happen to have a spare because reasons.... (hehehehehehe, I'mma bricking my own PC, imma bricking my....)

Is there any way to restore full ME in-case issues arise (aside from hardware SPI chip restore)? And do tools that interact with ME firmware still work?

[SaucyJack]

what makes you say that?

The website gives that impression. Only some of the modules are currently removed, and it depends on exactly what ME version you're dealing with.

[Adarion]

It's a start and step in the right direction. But to get rid of all this blob stuff in the firmware could be a lengthy walk...
I really dislike the idea of something that runs at ring <0 and is totally transparent to my OS kernel - but is possibly always active and has higher rights than my kernel. Especially when it can possibly be activated from a remote position or send data. Regardless if it's from intel, AMD, some ARM implementer...