Skip to content

Commit 1ad23f9

Browse files
tlauriontlaurion
committed
EOL_m900_tower-*: fix review comments — typos, blob names, board name
- blobs/m900/README.md: fix blob filenames, spelling (paritally->partially, Unfourtunatly->Unfortunately, layot->layout) - blobs/m900/m900_download_clean_deguard_me.sh: fix Dell->ASRock comment - boards/EOL_m900_tower-*: fix m900_tiny->m900_tower, fix ME script path, add 'tower' to CONFIG_BOARD_NAME - targets/m900_me_blobs.mk: rewrite header with accurate instructions Signed-off-by: Thierry Laurion <insurgo@riseup.net>
1 parent 0a6b9ef commit 1ad23f9

6 files changed

Lines changed: 36 additions & 25 deletions

File tree

‎blobs/m900/.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
me.bin
21
m900_me.bin
2+
me_cleaned.bin
33

‎blobs/m900/README.md‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22

33
The following blobs are needed:
44

5-
* `ifd.bin`
6-
* `gbe.bin`
7-
* `me.bin`
5+
* `m900_tower_ifd.bin`
6+
* `m900_tower_gbe.bin`
7+
* `m900_me.bin`
88

9-
## me.bin: automatically extract, deactivate, partially neuter and deguard
9+
## m900_me.bin: automatically extract, deactivate, partially neuter and deguard
1010

11-
download_clean_deguard_me.sh : Download vulnerable ME from ASRock, verify checksum, extract ME, deactivate ME and paritally neuter it, then apply the deguard patch and place it into me.bin.
11+
`m900_download_clean_deguard_me.sh`: Download vulnerable ME from ASRock, verify checksum, extract ME, deactivate ME and partially neuter it, then apply the deguard patch and place it into m900_me.bin.
1212
For the technical details please read the documentation in the script itself, as removing modules is limited on the platform.
1313

1414
The ME blob dumped in this directory comes from the following link: https://download.asrock.com/BIOS/1151/H110M-DGS(7.30)ROM.zip
@@ -27,11 +27,11 @@ As specified in the first link, this ME can be deployed to:
2727

2828
## ifd.bin and gbe.bin
2929

30-
Both blobs were taken from my donor board.
30+
Both blobs are from a production unit of this platform.
3131

32-
The GBE MAC address was forged to: `00:DE:AD:C0:FF:EE`. Unfourtunatly, after disabling the ME the onboard ethernet stop working. This was tested on coreboot and is true for heads too. So, PCI ethernet or usb/ethernet adapter is needed.
33-
IFD blob was unlocked using iftool. Moreover, to be sure, the HAP bit was set by altmedisable.
34-
The IFD layot was changed: the bios region was expanded to take space after reducing the me blob.
32+
The GBE MAC address was forged to: `00:DE:AD:C0:FF:EE`. Unfortunately, after disabling the ME the onboard ethernet stops working. This was tested on coreboot and is true for heads too. So, PCI ethernet or usb/ethernet adapter is needed.
33+
IFD blob was unlocked using ifdtool. Moreover, to be sure, the HAP bit was set by altmedisable.
34+
The IFD layout was changed: the bios region was expanded to take space after reducing the me blob.
3535

3636
## Integrity
3737

@@ -47,8 +47,7 @@ Sha256sums: `blobs/m900/hashes.txt`
4747
4848
# Documentation
4949

50-
A guide on how to flash this board (both the Heads rom) can be found here:
51-
https://osresearch.net/m900_tower-maximized-flashing/ #TODO
50+
A guide on how to flash this board can be found at https://osresearch.net/m900_tower-maximized-flashing/ (pending: the page needs to be created).
5251

5352
The upstream port for the board can be found here: https://review.coreboot.org/c/coreboot/+/74187
5453

‎blobs/m900/m900_download_clean_deguard_me.sh‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ function chk_exists_and_matches() {
3939
if echo "${2} ${1}" | sha256sum --check; then
4040
echo "SKIPPING: SHA256 checksum for $1 matches."
4141
[[ "$3" = ME ]] && me_exists="y"
42+
return 0
4243
fi
4344
echo "$1 exists but checksum doesn't match. Continuing..."
4445
fi
@@ -48,7 +49,7 @@ function download_and_clean() {
4849
me_cleaner="$(realpath "${1}")"
4950
me_output="$(realpath "${2}")"
5051

51-
# Download and unpack the Dell installer into a temporary directory and
52+
# Download and unpack the ASRock BIOS zip (compatible ME for this Lenovo platform) and
5253
# extract the deguardable Intel ME blob.
5354
pushd "$(mktemp -d)" || exit
5455

@@ -116,8 +117,14 @@ function parse_params() {
116117
while getopts ":m:" opt; do
117118
case $opt in
118119
m)
119-
if [[ -x "$OPTARG" ]]; then
120+
if [[ -f "$OPTARG" ]] && [[ ! -x "$OPTARG" ]]; then
121+
# me_cleaner is a Python script — passed to python interpreter,
122+
# not executed directly. Only require readability, not +x.
120123
me_cleaner="$OPTARG"
124+
elif [[ -x "$OPTARG" ]]; then
125+
me_cleaner="$OPTARG"
126+
else
127+
usage_err "-m path '$OPTARG' does not exist or is not readable"
121128
fi
122129
;;
123130
?)

‎boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
2-
# Configuration for a m900_tiny running Qubes 4.3 and other Linux Based OSes (through kexec)
2+
# Configuration for a m900_tower running Qubes 4.3 and other Linux Based OSes (through kexec)
33
# CAVEATS:
44
# This board is vulnerable to a TPM reset attack, i.e. the PCRs are reset while the system is running.
55
# This attack can be used to bypass measured boot when an attacker succeeds at modifying the SPI flash.
@@ -8,7 +8,7 @@
88
# Make sure you understand the implications of the attack for your threat model before using this board.
99
# Includes
1010
# - Deactivated+partially neutered+deguarded ME and expanded consequent IFD BIOS regions
11-
# - More details can be found in the script under blobs/m900_tiny/m900_tiny_download_clean_deguard_me.sh
11+
# - More details can be found in the script under blobs/m900/m900_download_clean_deguard_me.sh
1212
# - Forged GBE MAC address to 00:DE:AD:C0:FF:EE
1313
# - Includes Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
1414

@@ -81,7 +81,7 @@ export CONFIG_BOOT_REQ_HASH=n
8181
export CONFIG_BOOT_REQ_ROLLBACK=n
8282
export CONFIG_BOOT_KERNEL_ADD=""
8383
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
84-
export CONFIG_BOARD_NAME="Thinkcentre m900-hotp-maximized"
84+
export CONFIG_BOARD_NAME="Thinkcentre m900_tower-hotp-maximized"
8585
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
8686

8787
BOARD_TARGETS := m900_me_blobs

‎boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
2-
# Configuration for a m900_tiny running Qubes 4.3 and other Linux Based OSes (through kexec)
2+
# Configuration for a m900_tower running Qubes 4.3 and other Linux Based OSes (through kexec)
33
# CAVEATS:
44
# This board is vulnerable to a TPM reset attack, i.e. the PCRs are reset while the system is running.
55
# This attack can be used to bypass measured boot when an attacker succeeds at modifying the SPI flash.
@@ -8,7 +8,7 @@
88
# Make sure you understand the implications of the attack for your threat model before using this board.
99
# Includes
1010
# - Deactivated+partially neutered+deguarded ME and expanded consequent IFD BIOS regions
11-
# - More details can be found in the script under blobs/m900_tiny/m900_tiny_download_clean_deguard_me.sh
11+
# - More details can be found in the script under blobs/m900/m900_download_clean_deguard_me.sh
1212
# - Forged GBE MAC address to 00:DE:AD:C0:FF:EE
1313
# - DOES NOT INCLUDE Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
1414

@@ -79,7 +79,7 @@ export CONFIG_BOOT_REQ_HASH=n
7979
export CONFIG_BOOT_REQ_ROLLBACK=n
8080
export CONFIG_BOOT_KERNEL_ADD=""
8181
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
82-
export CONFIG_BOARD_NAME="Thinkcentre m900-maximized"
82+
export CONFIG_BOARD_NAME="Thinkcentre m900_tower-maximized"
8383
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
8484

8585
BOARD_TARGETS := m900_me_blobs

‎targets/m900_me_blobs.mk‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
# Targets for downloading m900 ME blob, neutering it down to BUP+ROMP region and deactivating ME.
2-
3-
# m900-*-maximized boards require of you initially call one of the
4-
# following to have gbe.bin ifd.bin and me.bin
5-
# - blobs/m900/download_clean_me.sh
6-
# To download Lenovo original ME binary, neuter+deactivate ME
2+
#
3+
# m900-*-maximized boards require you to initially call:
4+
# make blobs/m900/m900_me.bin
5+
# which runs blobs/m900/m900_download_clean_deguard_me.sh to:
6+
# 1. Download the ASRock H110M-DGS BIOS zip containing ME 11.6.0.1126
7+
# 2. Extract, partially neuter and deguard the ME firmware
8+
# 3. Place the result into blobs/m900/m900_me.bin
9+
#
10+
# The IFD (m900_tower_ifd.bin) and GBE (m900_tower_gbe.bin) blobs are
11+
# taken from a donor board and committed to the repo directly.
712

813
# Make the Coreboot build depend on the following 3rd party blobs:
914
$(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: \

0 commit comments

Comments
 (0)