Dasharo upgrade 0.9.2 > 0.9.4 Intel ME HAP disable not available

[nije-to-sve]

Dasharo version

0.9.4

Dasharo variant

MSI Z790

Question text

Dear all, after upgrading to Dasharo 0.9.4 from 0.9.2 there is no option available to disable Intel ME HAP only soft way, would like to know if this is a bug, expected on this version or unknown.

[zirblazer]

On the Z790-P series (But NOT on the Z690-A), MSI locks writing via Software to some descriptor that is required to be accessible for HAP Bit to work. Older Dasharo versions allowed you to set HAP to disable but it did nothing if the descriptor is locked (Which can be checked because the ME Device is still visible on lspci at 00:16.0), which it will be unless you used either FlashBIOS or external flashing cause you can't change that via Software flashing, making Dasharo Tools Suite not very useful for the Z790-P. Newer Dasharo versions hide HAP disable if the descriptor is locked, but doesn't tell you why it does that. So is likely you always had the descriptor locked and HAP Bit never worked on the first place.

[pietrushnic]

Newer Dasharo versions hide HAP disable if the descriptor is locked, but doesn't tell you why it does that.

@miczyg1 sounds like a UX issue, can we do anything with that?

[nije-to-sve]

On the Z790-P series (But NOT on the Z690-A), MSI locks writing via Software to some descriptor that is required to be accessible for HAP Bit to work. Older Dasharo versions allowed you to set HAP to disable but it did nothing if the descriptor is locked (Which can be checked because the ME Device is still visible on lspci at 00:16.0), which it will be unless you used either FlashBIOS or external flashing cause you can't change that via Software flashing, making Dasharo Tools Suite not very useful for the Z790-P. Newer Dasharo versions hide HAP disable if the descriptor is locked, but doesn't tell you why it does that. So is likely you always had the descriptor locked and HAP Bit never worked on the first place.

Thank you, just tested - exactly as you said. Flashing via FlashBIOS, 'HAP disable' is visible and I was wondering why process is throwing errors when flashing via flashrom.

Thanks again for the time and help.

[miczyg1]

Newer Dasharo versions hide HAP disable if the descriptor is locked, but doesn't tell you why it does that.

@miczyg1 sounds like a UX issue, can we do anything with that?

Wouldn't hurt to show a sentence in the setup UI that descriptor is locked and HAP is not available. Just like we do for grayed out Secure Boot enable without enrolled PK.

Dasharo/edk2@d3d9ca0
@mkopec assigning you to address this as the author of the change.

Also I don't think the code handles a case where descriptor is locked but HAP is enabled. So the menu can't reflect the state of ME properly.