Skip to content

Commit 78366db

Browse files
tlauriontlaurion
committed
EOL_m900_tower-*: fix review comments — typos, blob names, board name
- blobs/m900/README.md: fix blob filenames, spelling (paritally->partially, Unfourtunatly->Unfortunately, layot->layout) - blobs/m900/m900_download_clean_deguard_me.sh: fix Dell->ASRock comment - boards/EOL_m900_tower-*: fix m900_tiny->m900_tower, fix ME script path, add 'tower' to CONFIG_BOARD_NAME - targets/m900_me_blobs.mk: rewrite header with accurate instructions
1 parent 7372ed9 commit 78366db

5 files changed

Lines changed: 24 additions & 19 deletions

File tree

‎blobs/m900/README.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22

33
The following blobs are needed:
44

5-
* `ifd.bin`
6-
* `gbe.bin`
7-
* `me.bin`
5+
* `m900_tower_ifd.bin`
6+
* `m900_tower_gbe.bin`
7+
* `m900_me.bin`
88

9-
## me.bin: automatically extract, deactivate, partially neuter and deguard
9+
## m900_me.bin: automatically extract, deactivate, partially neuter and deguard
1010

11-
download_clean_deguard_me.sh : Download vulnerable ME from ASRock, verify checksum, extract ME, deactivate ME and paritally neuter it, then apply the deguard patch and place it into me.bin.
11+
`m900_download_clean_deguard_me.sh`: Download vulnerable ME from ASRock, verify checksum, extract ME, deactivate ME and partially neuter it, then apply the deguard patch and place it into m900_me.bin.
1212
For the technical details please read the documentation in the script itself, as removing modules is limited on the platform.
1313

1414
The ME blob dumped in this directory comes from the following link: https://download.asrock.com/BIOS/1151/H110M-DGS(7.30)ROM.zip
@@ -29,9 +29,9 @@ As specified in the first link, this ME can be deployed to:
2929

3030
Both blobs were taken from my donor board.
3131

32-
The GBE MAC address was forged to: `00:DE:AD:C0:FF:EE`. Unfourtunatly, after disabling the ME the onboard ethernet stop working. This was tested on coreboot and is true for heads too. So, PCI ethernet or usb/ethernet adapter is needed.
32+
The GBE MAC address was forged to: `00:DE:AD:C0:FF:EE`. Unfortunately, after disabling the ME the onboard ethernet stop working. This was tested on coreboot and is true for heads too. So, PCI ethernet or usb/ethernet adapter is needed.
3333
IFD blob was unlocked using iftool. Moreover, to be sure, the HAP bit was set by altmedisable.
34-
The IFD layot was changed: the bios region was expanded to take space after reducing the me blob.
34+
The IFD layout was changed: the bios region was expanded to take space after reducing the me blob.
3535

3636
## Integrity
3737

‎blobs/m900/m900_download_clean_deguard_me.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ function download_and_clean() {
4848
me_cleaner="$(realpath "${1}")"
4949
me_output="$(realpath "${2}")"
5050

51-
# Download and unpack the Dell installer into a temporary directory and
51+
# Download and unpack the ASRock BIOS zip (compatible ME for this Dell platform) and
5252
# extract the deguardable Intel ME blob.
5353
pushd "$(mktemp -d)" || exit
5454

‎boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
2-
# Configuration for a m900_tiny running Qubes 4.3 and other Linux Based OSes (through kexec)
2+
# Configuration for a m900_tower running Qubes 4.3 and other Linux Based OSes (through kexec)
33
# CAVEATS:
44
# This board is vulnerable to a TPM reset attack, i.e. the PCRs are reset while the system is running.
55
# This attack can be used to bypass measured boot when an attacker succeeds at modifying the SPI flash.
@@ -8,7 +8,7 @@
88
# Make sure you understand the implications of the attack for your threat model before using this board.
99
# Includes
1010
# - Deactivated+partially neutered+deguarded ME and expanded consequent IFD BIOS regions
11-
# - More details can be found in the script under blobs/m900_tiny/m900_tiny_download_clean_deguard_me.sh
11+
# - More details can be found in the script under blobs/m900/m900_download_clean_deguard_me.sh
1212
# - Forged GBE MAC address to 00:DE:AD:C0:FF:EE
1313
# - Includes Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
1414

@@ -81,7 +81,7 @@ export CONFIG_BOOT_REQ_HASH=n
8181
export CONFIG_BOOT_REQ_ROLLBACK=n
8282
export CONFIG_BOOT_KERNEL_ADD=""
8383
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
84-
export CONFIG_BOARD_NAME="Thinkcentre m900-hotp-maximized"
84+
export CONFIG_BOARD_NAME="Thinkcentre m900_tower-hotp-maximized"
8585
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
8686

8787
BOARD_TARGETS := m900_me_blobs

‎boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
2-
# Configuration for a m900_tiny running Qubes 4.3 and other Linux Based OSes (through kexec)
2+
# Configuration for a m900_tower running Qubes 4.3 and other Linux Based OSes (through kexec)
33
# CAVEATS:
44
# This board is vulnerable to a TPM reset attack, i.e. the PCRs are reset while the system is running.
55
# This attack can be used to bypass measured boot when an attacker succeeds at modifying the SPI flash.
@@ -8,7 +8,7 @@
88
# Make sure you understand the implications of the attack for your threat model before using this board.
99
# Includes
1010
# - Deactivated+partially neutered+deguarded ME and expanded consequent IFD BIOS regions
11-
# - More details can be found in the script under blobs/m900_tiny/m900_tiny_download_clean_deguard_me.sh
11+
# - More details can be found in the script under blobs/m900/m900_download_clean_deguard_me.sh
1212
# - Forged GBE MAC address to 00:DE:AD:C0:FF:EE
1313
# - DOES NOT INCLUDE Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
1414

@@ -79,7 +79,7 @@ export CONFIG_BOOT_REQ_HASH=n
7979
export CONFIG_BOOT_REQ_ROLLBACK=n
8080
export CONFIG_BOOT_KERNEL_ADD=""
8181
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
82-
export CONFIG_BOARD_NAME="Thinkcentre m900-maximized"
82+
export CONFIG_BOARD_NAME="Thinkcentre m900_tower-maximized"
8383
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
8484

8585
BOARD_TARGETS := m900_me_blobs

‎targets/m900_me_blobs.mk‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
# Targets for downloading m900 ME blob, neutering it down to BUP+ROMP region and deactivating ME.
2-
3-
# m900-*-maximized boards require of you initially call one of the
4-
# following to have gbe.bin ifd.bin and me.bin
5-
# - blobs/m900/download_clean_me.sh
6-
# To download Lenovo original ME binary, neuter+deactivate ME
2+
#
3+
# m900-*-maximized boards require you to initially call:
4+
# make blobs/m900/m900_me.bin
5+
# which runs blobs/m900/m900_download_clean_deguard_me.sh to:
6+
# 1. Download the ASRock H110M-DGS BIOS zip containing ME 11.6.0.1126
7+
# 2. Extract, partially neuter and deguard the ME firmware
8+
# 3. Place the result into blobs/m900/m900_me.bin
9+
#
10+
# The IFD (m900_tower_ifd.bin) and GBE (m900_tower_gbe.bin) blobs are
11+
# taken from a donor board and committed to the repo directly.
712

813
# Make the Coreboot build depend on the following 3rd party blobs:
914
$(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: \

0 commit comments

Comments
 (0)