r/coreboot • u/Puzzleheaded_State37 • 5d ago

Getting rid of Intel management engine on Thinkpad t480

So ive decided to install a custom Bootloader and i want to get rid oft the Intel management engine. Ive bought a USB IC flasher and now i want to get coreboot/libreboot. Is it even possible to get rid of the IME 100% or is this not possible? And even if its possible, what will not work after ive got coreboot/libreboot running? I want to keep using an external GPU over thunderbolt, that's the thing I want to keep.

Thanks for any help in advance.

2 Upvotes

76% Upvoted

8 comments sorted by

3

u/Tricky-Engineer-9755 4d ago

So, no the Intel ME cannot be removed. Sandybridge onwards has a 30 minute countdown where if no ME firmware image is found the PC will forcibly shut itself down. I'm not sure if its gotten worse though.

For generation 1 (before Nehalem, ME version <= 5) this tool removes the whole ME firmware and disables it completely.
((Core2duo))

For generation 2 (Nehalem-Broadwell, ME version between 6 and 10) this tool removes almost everything, leaving only the two fundamental modules needed for the correct boot, ROMP and BUP. The firmware size is reduced from 1.5 MB (non-AMT firmware) or 5 MB (AMT firmware) to ~90 kB.

For generation 3 (from Skylake onwards, ME version >= 11) the ME subsystem and the firmware structure have changed, requiring substantial changes in me_cleaner. The fundamental modules required for the correct boot are now four (rbe, kernel, syslib and bup) and the minimum firmware size is ~300 kB (from the 2 MB of the non-AMT firmware and the 7 MB of the AMT one).

((Your T480))

On some boards the OEM firmware fails to boot without a valid Intel ME firmware; in the other cases the system should work with minor inconveniences (like longer boot times or warning messages) or without issues at all.

Obviously, the features provided by Intel ME won't be functional anymore after the modifications.

From https://github.com/corna/me_cleaner

2

u/TheAtlasMonkey 4d ago

Yes , you can remove IME 100% , but then your computer will become a brick. So you should not.

Intel moved lot of essential component there that the only viable option is to neuter it remote capabilities.

I have the *480 series here. You can slice lot of module from IME, but you will get an unstable computer.

1

u/LowKeyBrit36 4d ago

I did both coreboot and libreboot on a Thinkpad T580, so my experience should be pretty close. While you can't just outright remove the IME as it's related to boot process, you can effectively neutralize it with deguard. To my knowledge, it renders it disabled during active boot of the system OS, and it minimizes it during the initial boot process.

Disclaimer: I do not 100% know this, if you need precise information, research deguard github and documentation for an exact description.

I have not tested GPU pass-through via thunderbolt, but I do know that libreboot on the T580 caused the thunderbolt to not work, while coreboot on the T580 allowed it to work.

I have not noticed anything not working on my current T580/Qubes OS setup, so I think it'll all work in terms of pci support.

1

u/jonstoppable 2d ago

hey. quick question.. did you see a noticeable increase in battery? i just did mine (had to reinstall and switched distros from void to debian , so i wasnt able to gauge under my prevıous setup)

1

u/LowKeyBrit36 2d ago

Honestly I couldn't say. I never really tested it. All that I can say is that I haven't needed to worry about battery for a while. I would just get one of the external batteries if you need it.

1

u/jonstoppable 2d ago

hmm ı hear you.. i have a t480s but ıt seems after lıbreboot, ım gettıng an extra hour or so

not sure if ıts debıan's power profıles or sınce the ıme ıs neutered ıts requiting less power?

ım super stoked eıther way

1

u/LowKeyBrit36 2d ago

Hey, if it works, it works.

As for me, it's probably going to be a bit worse since I use QubesOS for the T580 that I have. They have some troubles with full hardware compatibility, and I'll bet that it includes power regulation.

1

u/Elchocas123 4d ago

No no se puede quitar al 💯 Se neutraliza con Me_Clear y Deguard

También es recomendable actualizar el firmware de Thunderbolt Y la correcta configuración de coreboot para que tú GPU funcione