Re: [coreboot] Removing Intel ME from the X230 coreboot

[Federico Amedeo Izzo]

On 11/06/2016 10:11 AM, Charlotte Plusplus wrote:
> Hello
>
> Did you release any of your work to remove the ME for a X230?
>
> I am interested in attempting that on a W520. On
> https://www.coreboot.org/pipermail/coreboot/2016-September/082049.html
> you mention you left ROMP, BUP, KERNEL, POLICY and FTCS. Any update on
> that? Is it the minimal set??
>
> I assume you made a script that takes a ME firmware, reads it
> partition, then dd some parts of it to 0xFF. Can I please get a copy??
>
> Thanks!

Hello,

Lately I worked with Nicola Corna on disabling the intel ME, following
the results of Trammell Hudson.

We also made a python script that removes all the partitions but FTPR
and the corresponding entry in the FPT table, the results boots fine on
a Sandy Bridge X220 & X220t but leads to a brick on Nehalem X201.

You can find more details here along with the script
https://www.coreboot.org/pipermail/coreboot/2016-November/082331.html

Federico

Removing Intel ME from the X230 coreboot

[Charlotte Plusplus]

Hello

Thanks a lot for your detailed report. I would be happy to contribute
to your tests with my Ivy Bridge Thinkpad W520.

I have been using the ME from
https://www.dropbox.com/sh/mq1e2a54vv030nz/AAAgPSRYlPhuXiZiRE9qJbwQa

It is 1.5MB, which leaves me about 7MB for the payload:

CONFIG_CBFS_SIZE=0x680000

With the following layout:

1 00000000:00000fff fd
  2 00180000:007fffff bios
  3 00003000:0017ffff me
  4 00001000:00002fff gbe

The system did not poweroff after 30 min, but I would like to strip
down everything I can out of the intel ME. Your approach is
interesting. What is the minimal size you can presently get?

Using your python script on my 1.5 me.bin, I get FFs after 0x906C0

Can I adjust the IFD accordingly to scrape this extra space, or will I
run into problems as Tramell said the ME wants to write  to its own
partition?

Have you been able to test Igor suggestions to further trim the intel ME?

Thanks
Charlotte

On 11/6/16, Federico Amedeo Izzo  wrote:
> On 11/06/2016 10:11 AM, Charlotte Plusplus wrote:
> > Hello
> >
> > Did you release any of your work to remove the ME for a X230?
> >
> > I am interested in attempting that on a W520. On
> > https://www.coreboot.org/pipermail/coreboot/2016-September/082049.html
> > you mention you left ROMP, BUP, KERNEL, POLICY and FTCS. Any update on
> > that? Is it the minimal set??
> >
> > I assume you made a script that takes a ME firmware, reads it
> > partition, then dd some parts of it to 0xFF. Can I please get a copy??
> >
> > Thanks!
>
> Hello,
>
> Lately I worked with Nicola Corna on disabling the intel ME, following
> the results of Trammell Hudson.
>
> We also made a python script that removes all the partitions but FTPR
> and the corresponding entry in the FPT table, the results boots fine on
> a Sandy Bridge X220 & X220t but leads to a brick on Nehalem X201.
>
> You can find more details here along with the script
> https://www.coreboot.org/pipermail/coreboot/2016-November/082331.html
>
> Federico