Potential candidate for open source bootloaders? Complete removal of Intel ME firmware possible on certain Intel HEDT/Server platforms

reddit

(Also posted on r/Intel, r/hardware, r/privacy, r/libreboot and r/coreboot)

Introduction

Recently, Github user nkht has reported success in removing the entire Intel ME firmware from his/her Asus Rampage IV Extreme motherboard. Apparently, the Intel ME Watchdog is not active in some/all of the existing X79 PCH and hence the system does not turn off every 30 minutes as expected. I then attempted this on my Asus Rampage IV Gene motherboard and also obtained similar results.

The findings can be found on the following links:

https://github.com/corna/me_cleaner/issues/278

https://github.com/nkht/me_removal

What has been removed

Basically, the entire "ME region" in the BIOS image has been cleared by replacing the region with "FF" using a Hex Editor/UEFITool. Additionally, the MEI controller initialization can be halted by flipping a bit in the MEPlatformPEI module found in the BIOS Region.

What still remains

Intel CPU Microcode update, OEM BIOS implementation, OEM EC Firmware and Intel FSP(if applicable) are still largely untouched. This modification is not meant to be a complete/comprehensive open-source firmware replacement, although it can be easily integrated into said solutions for applicable platforms/systems in the future.

Comparison with ME_Cleaner

ME_Cleaner generally performs the following, depending on which flags are used, and the ME version:

  • For Intel ME 6.x to 10.x, most modules are removed except ROMP and BUP. Optionally or alternatively, the undocumented AltMeDisable bit can be activated to neutralize Intel ME.
  • For Intel ME 11.x, most modules are removed except RBE, Kernel, Syslib and BUP. Optionally or alternatively, the undocumented HAP bit can be set to neutralize Intel ME.

In the case of a complete ME firmware removal, the ROMP and BUP modules are also removed in place of 'FF's, halting any ME functions even earlier than what ME_Cleaner is capable of achieving.

Potentially compatible sockets/systems

LGA2011-0, LGA2011-1, LGA1356: Motherboards using the X79/C600 series chipset

Untested/unknown sockets/systems

LGA1366: Motherboards using the X58/5000 series chipset

LGA1567: Motherboards using the 7500 chipsets

LGA2011-3: Motherboards using the X99/C612 chipset

Likely incompatible sockets/systems

Any system running Skylake or newer CPUs, as their ME mechanism have changed substantially

Most mainstream LGA115X platforms and mobile platforms, especially for those using iGPU

All systems with Intel Boot Guard enabled by the manufacturer

Potential downsides of removing Intel ME completely

Of course, there can be downsides if you wish to remove Intel ME completely. First of all, if your PCH has an active watchdog timer, your system will turn off after 30 minutes, or stop booting altogether and you will need to re-flash your backup BIOS. Intel vPro capabilities found on server motherboards for example will no longer be available after applying this modification. Like all tests/mods, you may also experience instability or broken features as a result. For example, the LAN port may not function after a cold boot and requires re-initialization or a reboot. POST timings might also be impacted as a result of this modification.

To test this yourself

If you would like to attempt this modification yourself, you may proceed to the links above to give it a try. Do keep in mind that you might require a CH341a flasher in case the BIOS flash fails. This is especially the case since we are attempting to write on the Intel ME region which is often write-protected from the OS. It will also be a good idea to backup your current BIOS (not just download from vendors website), which includes the motherboard UUID, Serial Number and MAC address using various tools such as FTK8/FTK9, or dumping via the SPI flasher. For Asus motherboards with USB Flashback, you may rename the modified .CAP file to ERALL.CAP and flash using a USB Drive. Do keep in mind to add your motherboard UUID, Serial Number and MAC address to ERALL.CAP using FD44, otherwise those information may be permanently lost.

Conclusion

It seems like some Intel chipsets (more likely those with ME 6.x to 10.x, in other words Nehalem to Broadwell) could be shipped with deactivated ME watchdog timers. In this case, it is possible to remove the Intel ME firmware entirely which can be desirable for users seeking for open source firmware, or for privacy conscious users who suspect that the ME region may contain malicious code. However, the exact chipsets which do not have the active timer are still relatively unknown, and are more likely applicable to server/HEDT platforms.

submitted by /u/weareanomalous
[link] [comments]

Leave a Reply

Your email address will not be published. Required fields are marked *