The X201 is interesting: it is a close parent of the X200, but with a nice multitouch trackpad. Also, it is at the moment the first thinkpad model that can not be deblobbed: removing AMT apparently causes reboots after 30 minutes.
Since the same issues prevents the liberation of any model after the X200, I got myself a X201 tablet and attempted to work around the problem in a "creative" way. My idea is the AMT chip might wait for some minimal amount of code to disable the watchdog before receiving the "real" AMT payload. If this minimal amount of code could be found, it could be replicated without passing the AMT payload, to keep the AMT chip happy so it won't reboot the machine, without allowing it to spy on the user.
I started corrupting the AMT flash to see what exactly was needed to remove AMT while fixing the reboot problems (first on the default BIOS), to first have a working solution before extrapolating any further.
At the moment, I have a X201 that works fine, does not reboot after 30 minutes (tested during 16 hours) while exhibiting all the symptoms of AMT problems :
- long boot delay with the default BIOS
- AMT can't be found by non free operating systems with AMT drivers
- AMT can't be found, updated or reflashed using the non free Intel tool ME6 "FWUpdLcl"
(The only problem is the message "intel ips 0000:00:1f.6: ME failed to update for more than 1s, likely hung", which will be investigated later)
While this is a step in the right direction, I still have the device showing up with lspci. It might be due to me still using the default BIOS for my tests. I was trying to flash libreboot on a X200 tablet to check lspci, but I couldn't find the flash chip on the motherboard (it's a separate message)