New BIOS option: "ME Operation Mode" (Temporary Disabled setting)

[ruany]

Board: ASUS PRIME Z270-P (Kaby Lake)
BIOS: 1205 (2018/05/25)

After updating BIOS I've found a new option under PCH-FW Configuration.

Is this effectively the same as Alt Disable Mode (HAP/AltMeDisable)?
My system does not shut down after 30 minutes while using this option.

Intel ME PCI device is missing:

~ » lspci|grep ME
~ » 

~/workspace/coreboot/util/intelmetool » sudo ./intelmetool -m
Can't find ME PCI device

I've searched around on "ME Operation Mode" and got no useful results at all.

BIOS changelog states "Intel New ME Update, Improve Stability."

[bol-van]

No, its not. It look same as FPT me disable option.
Its' achieved by sending some special bytes to HECI interface. Upon reception me freezes itself and does not answer anymore to HECI.
In your case ASUS added option to send those magic bytes in bios code.

[ruany]

Interesting. It feels like I'm the first person to notice this option, and I haven't seen any mention of such a BIOS option in the wikis or elsewhere, only a hardware switch (#195, #135)

The similarity with the jumper disable method is that it apparently allows for the ME to be flashed using FPT. And since this option can be toggled from BIOS, theoretically ME can be fully neutered through internal flashing without ever touching hardware or flashing motherboard firmware (correct me if I am wrong).

I've noticed no side effects whatsoever from disabling ME using this BIOS option. Network is fine, all hardware works as expected, fully stable.

[bol-van]

You can do a test.
Do not enable "temporary disable" mode in bios.
Run "fpt -disableme"
or same thing in linux by : https://github.com/bol-van/me-disable
and test if ME region becomes writable

[ValoWaking]

"ME will go back to normal mode once power off..."

[ruany]

@ValoWaking
Yes, I've noticed that, however, I've found that it only has to be re-applied on hard resets, not soft resets* (so /usr/bin/reboot is ok) (*depends on whether BIOS does fast boot on reset, maybe some other factors). Also, it persists after suspend-resume (suspend to RAM, not hibernation to disk).

[OneB1t]

interesting is that for example my motherboard does not have that option O.o
Prime Z270-A with bios 1302

[0100001001000010]

Not sure if it's meaningful, but my new Ice Lake laptop (Acer Aspire 5 A515-55-56VK, InsydeH2O rev 5) has that option too. On mine, it has the siide effect of making suspend/resume work exactly once after a reboot, and then the system will freeze after Linux tries to suspend the second time. (After a reboot, the kernel's last words in the log show no problems and the system having successfully prepared and about to enter the low power state.) It cannot be woken up except by holding the power button, the keyboard backlight (which is not exposed to the OS so is presumably controlled by the EC) turns off and won't come back on, and the display is turned off, but the fan still runs and the power light remains steady blue. (Sleep = flashing orange.) systemctl poweroff shuts down the OS but does not power down the computer if I've used up the first suspend. That's the only side effect I've noticed, though it's quite a bad one so I had to re-enable it.

[the-j0k3r]

@ruany and apologies to everyone for this (late) reply, its a topic of some interest for myself.

That was added so that when you update your Bios it wont send the ME into recovery mode because its Tuesday, Such issues include messages like the following to display after P.O.S.T.

A7 ME FW Downgrade Request MESpilock failed

Machine will work fine without shutdowns (as Ive observed) or other side effects but it will take your startup time to 70seconds or 90seconds depending on Bios settings. (as opposed to 10 seconds or there abouts)

But sadly not all z270's have that option and none of the methods of flashing BIOS Asus provides for bios recovery, CMOS clearing, etc will fix this and more often than not after flashing Bios or ME will cause this on motherboards that dont have a service mode of sorts except by shorting audio chip pins.. At least I'm not aware of any other solution to this issue.

So instead they added that option, so that bios update or ME updates dont cause this problem, and its a more widespread/common issue than Asus admits and also provides no support for because Asus are the best at customer support (not).

Only way to fix then is by HW programmers to bypass FD software locks etc or shorting pins on audio chip and reflashing.

As a side note, when doing repairs to my equipment or others, I would rather disable the ME via HAP mode or me_cleaner rather than use the ME images floating around the web, cause most wont be able to discern if the ME bins are clean or contain some payload/module that maybe tainted, and not everyone (regular users) has skills to view the contents in hex editor and know whats going on or some other method.

Its important to mention, I'm not stating the updated ME.bins around the web contain any questionable payloads, but it would be remiss of me not to mention it could easily happen if the source for said bins (users trust) is compromised by some nefarious entity.

Personally I dont understand why the Updated bios version dont contain an updated ME region and instead all will be older version than the manufacturer provides, this may also cause issues upon flashing, I may be wrong here but Im not an expert on ME or Bioses in any case.

Asus will not provide any more official ME updates for z270's in any case, only 1 update was done and no matter how many CVE's ME has, your only choice as a regular user is to use ME bins that may or may not do more harm than good.

[ruany]

@the-j0k3r
Startup time is unaffected on my side, with or without ME Temporary Disabled it takes under 10 seconds to boot (from POST to desktop)

No issues with suspend/resume either. After all these years I've still noticed no negative effects from this option, besides the mild inconvenience of using it.

[0100001001000010]

That was added so that when you update your Bios it wont send the ME into recovery mode because its Tuesday, Such issues include messages like the following to display after P.O.S.T.

Wait, is the Tuesday thing literal or figurative? I would hope it's figurative, but knowing how shitty OEM firmware tends to be, I wouldn't be surprised by bugs that occur only on Tuesday in things that shouldn't be using the rtc at all.

If the option is meant to be a workaround to an issue triggered when updating, why doesn't the firmware just turn it set to temporary disabled automatically before update and back on after update, not exposing it to the end user? That sounds like it would be better for UX than consumers potentially bricking their mobo because they didn't change a setting before updating because they didn't know the update routine didn't actually do the entire process for them. Am I missing something (I'm not that familiar with firmware) or is this just an instance of OEM firmware crappiness?

[the-j0k3r]

@the-j0k3r
Startup time is unaffected on my side, with or without ME Temporary Disabled it takes under 10 seconds to boot (from POST to desktop)

I never said it was, I explained why the feature you described is implemented to prevent such issues when flashing. You are a very lucky person, because most of z270 and other series dont have this setting and are all plagued by that issue at best, at worst they will shutdown after a while.

Wait, is the Tuesday thing literal or figurative

Pick a day, anyday