4 ms·

>> or if they allowed complete disabling via motherboard jumper > That wouldn't really work; the ME is essentially "the CPU" of the Platform Controller Hub. Di

>> or if they allowed complete disabling via motherboard jumper > That wouldn't really work; the ME is essentially "the CPU" of the Platform Controller Hub. Disabling it would be disabling your computer (e.g. your IOMMU, your DRAM refresh, your ACPI command routing, etc.) Then how does Intel disable it for governmental customers (high-assurance)?

rphlx 9y ago
The GP is simply wrong on many/most of its technical claims. ACPI implementations were common for 4+ years before the ME existed. The ME is not involved in DRAM refresh or initialization at all (other than waiting for it to complete..). DRAM refresh is hardened into the IMC, and the initialization SW runs on the x86_64 cores - typically it's a UEFI binary blob provided by Intel. Once the OS is running, it manages the IOMMU, and the IOMMU itself is a hardened function; the translations that it performs for the OS do not involve the ME. And so on. Though the ME currently performs some complex early initialization tasks, the notion that a modern x86_64 platform simply cannot work, or cannot work efficiently, without the ME running indefinitely/alongside the OS is plainly wrong.
- throwaway613834 9y ago
  Yeah I always thought DRAM refresh was built into the hardware, so this was kind of shocking for me to read too. I assumed he knew what he was talking since I couldn't imagine why else he would think it's something done by the ME.
- zkms 9y ago
  > The GP is simply wrong on many/most of its technical claims I concur. Also regarding: ACPI, there often is an auxiliary microcontroller used to do power management and keyboard interfacing called "embedded controller" (sometimes there's also a mysterious ASIC, part numbers for them include Rohm BU77700KVT Toshiba TB62D515FG,TB62501F) that lives on some SMBus and with which the ACPI implementation, running on the main processor, talks with.
  - TD-Linux 9y ago
    On newer Thinkpads, the firmware for the EC is on the same SPI Flash as the ME firmware, but on a different partition. The EC is an entirely separate chip (labeled ThinkEngine) and by virtue of being only on SMBus is a lot less dangerous.
- TD-Linux 9y ago
  This is backed up by older systems working fine with the ME firmware completely removed, and on newer systems, for 30 minutes before a watchdog triggers: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner
- criddell 9y ago
  Are you sure? As I understood it, the first two things that the ME runs on boot do much of that configuration. I can never remember the name of the first, but the second is the bring-up (or BUP) module.
vbezhenar 9y ago
They don't disable it completely. Computer can't boot and work without ME.

rphlx 9y ago

The GP is simply wrong on many/most of its technical claims. ACPI implementations were common for 4+ years before the ME existed. The ME is not involved in DRAM refresh or initialization at all (other than waiting for it to complete..). DRAM refresh is hardened into the IMC, and the initialization SW runs on the x86_64 cores - typically it's a UEFI binary blob provided by Intel. Once the OS is running, it manages the IOMMU, and the IOMMU itself is a hardened function; the translations that it performs for the OS do not involve the ME. And so on. Though the ME currently performs some complex early initialization tasks, the notion that a modern x86_64 platform simply cannot work, or cannot work efficiently, without the ME running indefinitely/alongside the OS is plainly wrong.

throwaway613834 9y ago
Yeah I always thought DRAM refresh was built into the hardware, so this was kind of shocking for me to read too. I assumed he knew what he was talking since I couldn't imagine why else he would think it's something done by the ME.
zkms 9y ago
> The GP is simply wrong on many/most of its technical claims I concur. Also regarding: ACPI, there often is an auxiliary microcontroller used to do power management and keyboard interfacing called "embedded controller" (sometimes there's also a mysterious ASIC, part numbers for them include Rohm BU77700KVT Toshiba TB62D515FG,TB62501F) that lives on some SMBus and with which the ACPI implementation, running on the main processor, talks with.
- TD-Linux 9y ago
  On newer Thinkpads, the firmware for the EC is on the same SPI Flash as the ME firmware, but on a different partition. The EC is an entirely separate chip (labeled ThinkEngine) and by virtue of being only on SMBus is a lot less dangerous.
TD-Linux 9y ago
This is backed up by older systems working fine with the ME firmware completely removed, and on newer systems, for 30 minutes before a watchdog triggers: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner
criddell 9y ago
Are you sure? As I understood it, the first two things that the ME runs on boot do much of that configuration. I can never remember the name of the first, but the second is the bring-up (or BUP) module.

vbezhenar 9y ago

They don't disable it completely. Computer can't boot and work without ME.