GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
coreboot-kgpe-d16/util/me_cleaner/README.md

45 lines
2.7 KiB
Markdown
Raw Normal View History

util/me_cleaner: Pull the latest changes from upstream Relevant changes (commit 2e8761e): * Add an option to truncate the ME image file * Add full support for Skylake (ME 11) and following, including modules removal, truncation informations and partition relocation * Add two options to generate a shrinked ME image file and the corresponding descriptor with a modified flash layout * Update README.md * Bug fixes Also add a link to the usage guide in the Kconfig help. Change-Id: I690c5d558139f64f38babf3c0988b53834ba8b37 Signed-off-by: Nicola Corna <nicola@corna.info> Reviewed-on: https://review.coreboot.org/20915 Reviewed-by: Arthur Heymans <arthur@aheymans.xyz> Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
2017-08-08 21:24:49 +02:00
# me_cleaner
util: Add me_cleaner me_cleaner is a tool to strip down Intel ME/TXE images by removing all the non-fundamental code, while keeping the ME/TXE image valid and suitable for booting the system. The remaining code (ROMP and BUP modules) is the one responsible for the very basic initialization of the ME/TXE subsystem and can't be removed. This tool exploits the fact that: * Each ME/TXE partition is signed individually and it is possible to remove both the partition and the signature. * The ME/TXE modules are not signed directly, instead they are hashed and the list of their hashes is hashed again and signed: this means that modifying a module doesn't invalidate the signature, but only the hash of that single module. * The modules hashes are checked only when the corresponding module needs to be executed. * The system can boot after the execution of the first module (BUP, inside the FTPR partition), even if the subsequent stages fail. Currently me_cleaner works on every Intel platform with Intel ME or Intel TXE with the following limitations: * Doesn't work when Intel Boot Guard is set in Verified Boot mode. * Doesn't fully work on Nehalem yet. * On Skylake and later generations, since the partitions' internal structure has changed, me_cleaner leaves intact the FTPR partition, removing all the the other partitions. This tool has been tested on multiple platforms and architectures by different users, and seems to be stable. The reports are available here: https://github.com/corna/me_cleaner/issues/3 A more in-depth description of me_cleaner is available here: https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F Change-Id: I9013799e9adea0dea0775b9afe718de5fc4ca748 Signed-off-by: Nicola Corna <nicola@corna.info> Reviewed-on: https://review.coreboot.org/18203 Tested-by: build bot (Jenkins) Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2017-01-23 15:28:24 +01:00
util/me_cleaner: Pull the latest changes from upstream Relevant changes (commit 2e8761e): * Add an option to truncate the ME image file * Add full support for Skylake (ME 11) and following, including modules removal, truncation informations and partition relocation * Add two options to generate a shrinked ME image file and the corresponding descriptor with a modified flash layout * Update README.md * Bug fixes Also add a link to the usage guide in the Kconfig help. Change-Id: I690c5d558139f64f38babf3c0988b53834ba8b37 Signed-off-by: Nicola Corna <nicola@corna.info> Reviewed-on: https://review.coreboot.org/20915 Reviewed-by: Arthur Heymans <arthur@aheymans.xyz> Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
2017-08-08 21:24:49 +02:00
Intel ME is a coprocessor integrated in all post-2006 Intel boards, for which
this [Libreboot page](https://libreboot.org/faq.html#intelme) has an excellent
description. The main component of Intel ME is Intel AMT, and I suggest you to
read [this Wikipedia page](https://en.wikipedia.org/wiki/Intel_Active_Management_Technology)
for more information about it. In short, Intel ME is an irremovable environment
with an obscure signed proprietary firmware, with full network and memory
access, which poses a serious security threat.
Even when disabled from the BIOS settings, Intel ME is active: the only way to
be sure it is disabled is to remove its firmware from the flash chip.
util: Add me_cleaner me_cleaner is a tool to strip down Intel ME/TXE images by removing all the non-fundamental code, while keeping the ME/TXE image valid and suitable for booting the system. The remaining code (ROMP and BUP modules) is the one responsible for the very basic initialization of the ME/TXE subsystem and can't be removed. This tool exploits the fact that: * Each ME/TXE partition is signed individually and it is possible to remove both the partition and the signature. * The ME/TXE modules are not signed directly, instead they are hashed and the list of their hashes is hashed again and signed: this means that modifying a module doesn't invalidate the signature, but only the hash of that single module. * The modules hashes are checked only when the corresponding module needs to be executed. * The system can boot after the execution of the first module (BUP, inside the FTPR partition), even if the subsequent stages fail. Currently me_cleaner works on every Intel platform with Intel ME or Intel TXE with the following limitations: * Doesn't work when Intel Boot Guard is set in Verified Boot mode. * Doesn't fully work on Nehalem yet. * On Skylake and later generations, since the partitions' internal structure has changed, me_cleaner leaves intact the FTPR partition, removing all the the other partitions. This tool has been tested on multiple platforms and architectures by different users, and seems to be stable. The reports are available here: https://github.com/corna/me_cleaner/issues/3 A more in-depth description of me_cleaner is available here: https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F Change-Id: I9013799e9adea0dea0775b9afe718de5fc4ca748 Signed-off-by: Nicola Corna <nicola@corna.info> Reviewed-on: https://review.coreboot.org/18203 Tested-by: build bot (Jenkins) Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2017-01-23 15:28:24 +01:00
util/me_cleaner: Pull the latest changes from upstream Relevant changes (commit 2e8761e): * Add an option to truncate the ME image file * Add full support for Skylake (ME 11) and following, including modules removal, truncation informations and partition relocation * Add two options to generate a shrinked ME image file and the corresponding descriptor with a modified flash layout * Update README.md * Bug fixes Also add a link to the usage guide in the Kconfig help. Change-Id: I690c5d558139f64f38babf3c0988b53834ba8b37 Signed-off-by: Nicola Corna <nicola@corna.info> Reviewed-on: https://review.coreboot.org/20915 Reviewed-by: Arthur Heymans <arthur@aheymans.xyz> Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
2017-08-08 21:24:49 +02:00
Before Nehalem (ME version 6, 2008/2009) the ME firmware could be removed
completely from the flash chip by setting a couple of bits inside the flash
descriptor, without the need to reverse-engineer the ME firmware.
util: Add me_cleaner me_cleaner is a tool to strip down Intel ME/TXE images by removing all the non-fundamental code, while keeping the ME/TXE image valid and suitable for booting the system. The remaining code (ROMP and BUP modules) is the one responsible for the very basic initialization of the ME/TXE subsystem and can't be removed. This tool exploits the fact that: * Each ME/TXE partition is signed individually and it is possible to remove both the partition and the signature. * The ME/TXE modules are not signed directly, instead they are hashed and the list of their hashes is hashed again and signed: this means that modifying a module doesn't invalidate the signature, but only the hash of that single module. * The modules hashes are checked only when the corresponding module needs to be executed. * The system can boot after the execution of the first module (BUP, inside the FTPR partition), even if the subsequent stages fail. Currently me_cleaner works on every Intel platform with Intel ME or Intel TXE with the following limitations: * Doesn't work when Intel Boot Guard is set in Verified Boot mode. * Doesn't fully work on Nehalem yet. * On Skylake and later generations, since the partitions' internal structure has changed, me_cleaner leaves intact the FTPR partition, removing all the the other partitions. This tool has been tested on multiple platforms and architectures by different users, and seems to be stable. The reports are available here: https://github.com/corna/me_cleaner/issues/3 A more in-depth description of me_cleaner is available here: https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F Change-Id: I9013799e9adea0dea0775b9afe718de5fc4ca748 Signed-off-by: Nicola Corna <nicola@corna.info> Reviewed-on: https://review.coreboot.org/18203 Tested-by: build bot (Jenkins) Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2017-01-23 15:28:24 +01:00
util/me_cleaner: Pull the latest changes from upstream Relevant changes (commit 2e8761e): * Add an option to truncate the ME image file * Add full support for Skylake (ME 11) and following, including modules removal, truncation informations and partition relocation * Add two options to generate a shrinked ME image file and the corresponding descriptor with a modified flash layout * Update README.md * Bug fixes Also add a link to the usage guide in the Kconfig help. Change-Id: I690c5d558139f64f38babf3c0988b53834ba8b37 Signed-off-by: Nicola Corna <nicola@corna.info> Reviewed-on: https://review.coreboot.org/20915 Reviewed-by: Arthur Heymans <arthur@aheymans.xyz> Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
2017-08-08 21:24:49 +02:00
Starting from Nehalem the Intel ME firmware can't be removed anymore: without a
valid firmware the PC shuts off forcefully after 30 minutes. This project is an
attempt to remove as much code as possible from such firmware without falling
into the 30 minutes recovery mode.
util: Add me_cleaner me_cleaner is a tool to strip down Intel ME/TXE images by removing all the non-fundamental code, while keeping the ME/TXE image valid and suitable for booting the system. The remaining code (ROMP and BUP modules) is the one responsible for the very basic initialization of the ME/TXE subsystem and can't be removed. This tool exploits the fact that: * Each ME/TXE partition is signed individually and it is possible to remove both the partition and the signature. * The ME/TXE modules are not signed directly, instead they are hashed and the list of their hashes is hashed again and signed: this means that modifying a module doesn't invalidate the signature, but only the hash of that single module. * The modules hashes are checked only when the corresponding module needs to be executed. * The system can boot after the execution of the first module (BUP, inside the FTPR partition), even if the subsequent stages fail. Currently me_cleaner works on every Intel platform with Intel ME or Intel TXE with the following limitations: * Doesn't work when Intel Boot Guard is set in Verified Boot mode. * Doesn't fully work on Nehalem yet. * On Skylake and later generations, since the partitions' internal structure has changed, me_cleaner leaves intact the FTPR partition, removing all the the other partitions. This tool has been tested on multiple platforms and architectures by different users, and seems to be stable. The reports are available here: https://github.com/corna/me_cleaner/issues/3 A more in-depth description of me_cleaner is available here: https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F Change-Id: I9013799e9adea0dea0775b9afe718de5fc4ca748 Signed-off-by: Nicola Corna <nicola@corna.info> Reviewed-on: https://review.coreboot.org/18203 Tested-by: build bot (Jenkins) Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2017-01-23 15:28:24 +01:00
util/me_cleaner: Pull the latest changes from upstream Relevant changes (commit 2e8761e): * Add an option to truncate the ME image file * Add full support for Skylake (ME 11) and following, including modules removal, truncation informations and partition relocation * Add two options to generate a shrinked ME image file and the corresponding descriptor with a modified flash layout * Update README.md * Bug fixes Also add a link to the usage guide in the Kconfig help. Change-Id: I690c5d558139f64f38babf3c0988b53834ba8b37 Signed-off-by: Nicola Corna <nicola@corna.info> Reviewed-on: https://review.coreboot.org/20915 Reviewed-by: Arthur Heymans <arthur@aheymans.xyz> Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
2017-08-08 21:24:49 +02:00
me_cleaner currently works on most architectures, see [me_cleaner status](https://github.com/corna/me_cleaner/wiki/me_cleaner-status) (or [its discussion](https://github.com/corna/me_cleaner/issues/3))
for more info about them. me_cleaner works also on the TXE and SPS firmware.
util: Add me_cleaner me_cleaner is a tool to strip down Intel ME/TXE images by removing all the non-fundamental code, while keeping the ME/TXE image valid and suitable for booting the system. The remaining code (ROMP and BUP modules) is the one responsible for the very basic initialization of the ME/TXE subsystem and can't be removed. This tool exploits the fact that: * Each ME/TXE partition is signed individually and it is possible to remove both the partition and the signature. * The ME/TXE modules are not signed directly, instead they are hashed and the list of their hashes is hashed again and signed: this means that modifying a module doesn't invalidate the signature, but only the hash of that single module. * The modules hashes are checked only when the corresponding module needs to be executed. * The system can boot after the execution of the first module (BUP, inside the FTPR partition), even if the subsequent stages fail. Currently me_cleaner works on every Intel platform with Intel ME or Intel TXE with the following limitations: * Doesn't work when Intel Boot Guard is set in Verified Boot mode. * Doesn't fully work on Nehalem yet. * On Skylake and later generations, since the partitions' internal structure has changed, me_cleaner leaves intact the FTPR partition, removing all the the other partitions. This tool has been tested on multiple platforms and architectures by different users, and seems to be stable. The reports are available here: https://github.com/corna/me_cleaner/issues/3 A more in-depth description of me_cleaner is available here: https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F Change-Id: I9013799e9adea0dea0775b9afe718de5fc4ca748 Signed-off-by: Nicola Corna <nicola@corna.info> Reviewed-on: https://review.coreboot.org/18203 Tested-by: build bot (Jenkins) Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2017-01-23 15:28:24 +01:00
util/me_cleaner: Pull the latest changes from upstream Relevant changes (commit 2e8761e): * Add an option to truncate the ME image file * Add full support for Skylake (ME 11) and following, including modules removal, truncation informations and partition relocation * Add two options to generate a shrinked ME image file and the corresponding descriptor with a modified flash layout * Update README.md * Bug fixes Also add a link to the usage guide in the Kconfig help. Change-Id: I690c5d558139f64f38babf3c0988b53834ba8b37 Signed-off-by: Nicola Corna <nicola@corna.info> Reviewed-on: https://review.coreboot.org/20915 Reviewed-by: Arthur Heymans <arthur@aheymans.xyz> Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
2017-08-08 21:24:49 +02:00
If you want to understand how me_cleaner works, you can read the ["How does it work?" page](https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F).
util: Add me_cleaner me_cleaner is a tool to strip down Intel ME/TXE images by removing all the non-fundamental code, while keeping the ME/TXE image valid and suitable for booting the system. The remaining code (ROMP and BUP modules) is the one responsible for the very basic initialization of the ME/TXE subsystem and can't be removed. This tool exploits the fact that: * Each ME/TXE partition is signed individually and it is possible to remove both the partition and the signature. * The ME/TXE modules are not signed directly, instead they are hashed and the list of their hashes is hashed again and signed: this means that modifying a module doesn't invalidate the signature, but only the hash of that single module. * The modules hashes are checked only when the corresponding module needs to be executed. * The system can boot after the execution of the first module (BUP, inside the FTPR partition), even if the subsequent stages fail. Currently me_cleaner works on every Intel platform with Intel ME or Intel TXE with the following limitations: * Doesn't work when Intel Boot Guard is set in Verified Boot mode. * Doesn't fully work on Nehalem yet. * On Skylake and later generations, since the partitions' internal structure has changed, me_cleaner leaves intact the FTPR partition, removing all the the other partitions. This tool has been tested on multiple platforms and architectures by different users, and seems to be stable. The reports are available here: https://github.com/corna/me_cleaner/issues/3 A more in-depth description of me_cleaner is available here: https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F Change-Id: I9013799e9adea0dea0775b9afe718de5fc4ca748 Signed-off-by: Nicola Corna <nicola@corna.info> Reviewed-on: https://review.coreboot.org/18203 Tested-by: build bot (Jenkins) Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com> Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
2017-01-23 15:28:24 +01:00
util/me_cleaner: Pull the latest changes from upstream Relevant changes (commit 2e8761e): * Add an option to truncate the ME image file * Add full support for Skylake (ME 11) and following, including modules removal, truncation informations and partition relocation * Add two options to generate a shrinked ME image file and the corresponding descriptor with a modified flash layout * Update README.md * Bug fixes Also add a link to the usage guide in the Kconfig help. Change-Id: I690c5d558139f64f38babf3c0988b53834ba8b37 Signed-off-by: Nicola Corna <nicola@corna.info> Reviewed-on: https://review.coreboot.org/20915 Reviewed-by: Arthur Heymans <arthur@aheymans.xyz> Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
2017-08-08 21:24:49 +02:00
If you want to apply me_cleaner on your platform I suggest you to read the
["How does it work?" page](https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F)
and then follow the guide ["How to apply me_cleaner"](https://github.com/corna/me_cleaner/wiki/How-to-apply-me_cleaner).
For pre-Skylake firmware (ME version < 11) this tool removes almost everything,
leaving only the two fundamental modules needed for the correct boot, ROMP and
BUP. The code size is reduced from 1.5 MB (non-AMT firmware) or 5 MB (AMT
firmware) to ~90 kB of compressed code.
Starting from Skylake (ME version >= 11) the ME subsystem and the firmware
structure have changed, requiring substantial changes in me_cleaner.
The fundamental modules required for the correct boot are now four (rbe, kernel,
syslib and bup) and the minimum code size is ~300 kB of compressed code (from
the 2 MB of the non-AMT firmware and the 7 MB of the AMT one).
This project is based on the work of the community; in particular I thank Igor
Skochinsky, for the core information about Intel ME and its firmware structure,
and Federico Amedeo Izzo, for its help during the study of Intel ME.