Skip to content

Commit 83305bd

Browse files
tlauriontlaurion
committed
EOL_m900_tower-*: fix review comments -- typos, blob names, board name
Fix the blobs/m900 download script to source shared blobs/lib.sh and use its chk_sha256sum from the shared library (review comment). Update board config descriptions and fix typos in README and m900_me_blobs.mk target paths. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
1 parent 7562b9f commit 83305bd

6 files changed

Lines changed: 35 additions & 25 deletions

File tree

‎blobs/m900/.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
me.bin
21
m900_me.bin
2+
me_cleaned.bin
33

‎blobs/m900/README.md‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22

33
The following blobs are needed:
44

5-
* `ifd.bin`
6-
* `gbe.bin`
7-
* `me.bin`
5+
* `m900_tower_ifd.bin`
6+
* `m900_tower_gbe.bin`
7+
* `m900_me.bin`
88

9-
## me.bin: automatically extract, deactivate, partially neuter and deguard
9+
## m900_me.bin: automatically extract, deactivate, partially neuter and deguard
1010

11-
download_clean_deguard_me.sh : Download vulnerable ME from ASRock, verify checksum, extract ME, deactivate ME and paritally neuter it, then apply the deguard patch and place it into me.bin.
11+
`m900_download_clean_deguard_me.sh`: Download vulnerable ME from ASRock, verify checksum, extract ME, deactivate ME and partially neuter it, then apply the deguard patch and place it into m900_me.bin.
1212
For the technical details please read the documentation in the script itself, as removing modules is limited on the platform.
1313

1414
The ME blob dumped in this directory comes from the following link: https://download.asrock.com/BIOS/1151/H110M-DGS(7.30)ROM.zip
@@ -27,11 +27,11 @@ As specified in the first link, this ME can be deployed to:
2727

2828
## ifd.bin and gbe.bin
2929

30-
Both blobs were taken from my donor board.
30+
Both blobs are from a production unit of this platform.
3131

32-
The GBE MAC address was forged to: `00:DE:AD:C0:FF:EE`
33-
IFD blob was unlocked using iftool. Moreover, to be sure, the HAP bit was set by altmedisable.
34-
The IFD layot was changed: the bios region was expanded to take space after reducing the me blob.
32+
The GBE MAC address was forged to: `00:DE:AD:C0:FF:EE`. Unfortunately, after disabling the ME the onboard ethernet stops working. This was tested on coreboot and is true for heads too. So, PCI ethernet or usb/ethernet adapter is needed.
33+
IFD blob was unlocked using ifdtool. Moreover, to be sure, the HAP bit was set by altmedisable.
34+
The IFD layout was changed: the bios region was expanded to take space after reducing the me blob.
3535

3636
## Integrity
3737

@@ -47,8 +47,7 @@ Sha256sums: `blobs/m900/hashes.txt`
4747
4848
# Documentation
4949

50-
A guide on how to flash this board (both the Heads rom) can be found here:
51-
https://osresearch.net/m900_tower-maximized-flashing/ #TODO
50+
A guide on how to flash this board can be found at https://osresearch.net/m900_tower-maximized-flashing/ (pending: the page needs to be created).
5251

5352
The upstream port for the board can be found here: https://review.coreboot.org/c/coreboot/+/74187
5453

‎blobs/m900/m900_download_clean_deguard_me.sh‎

100755100644
Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ function download_and_clean() {
2828
me_cleaner="$(realpath "${1}")"
2929
me_output="$(realpath "${2}")"
3030

31-
# Download and unpack the Dell installer into a temporary directory and
31+
# Download and unpack the ASRock BIOS zip (compatible ME for this Lenovo platform) and
3232
# extract the deguardable Intel ME blob.
3333
pushd "$(mktemp -d)" || exit
3434

@@ -96,8 +96,14 @@ function parse_params() {
9696
while getopts ":m:" opt; do
9797
case $opt in
9898
m)
99-
if [[ -x "$OPTARG" ]]; then
99+
if [[ -f "$OPTARG" ]] && [[ ! -x "$OPTARG" ]]; then
100+
# me_cleaner is a Python script — passed to python interpreter,
101+
# not executed directly. Only require readability, not +x.
100102
me_cleaner="$OPTARG"
103+
elif [[ -x "$OPTARG" ]]; then
104+
me_cleaner="$OPTARG"
105+
else
106+
usage_err "-m path '$OPTARG' does not exist or is not readable"
101107
fi
102108
;;
103109
?)

‎boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
2-
# Configuration for a m900_tiny running Qubes 4.3 and other Linux Based OSes (through kexec)
2+
# Configuration for a m900_tower running Qubes 4.3 and other Linux Based OSes (through kexec)
33
# CAVEATS:
44
# This board is vulnerable to a TPM reset attack, i.e. the PCRs are reset while the system is running.
55
# This attack can be used to bypass measured boot when an attacker succeeds at modifying the SPI flash.
@@ -8,7 +8,7 @@
88
# Make sure you understand the implications of the attack for your threat model before using this board.
99
# Includes
1010
# - Deactivated+partially neutered+deguarded ME and expanded consequent IFD BIOS regions
11-
# - More details can be found in the script under blobs/m900_tiny/m900_tiny_download_clean_deguard_me.sh
11+
# - More details can be found in the script under blobs/m900/m900_download_clean_deguard_me.sh
1212
# - Forged GBE MAC address to 00:DE:AD:C0:FF:EE
1313
# - Includes Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
1414

@@ -81,7 +81,7 @@ export CONFIG_BOOT_REQ_HASH=n
8181
export CONFIG_BOOT_REQ_ROLLBACK=n
8282
export CONFIG_BOOT_KERNEL_ADD=""
8383
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
84-
export CONFIG_BOARD_NAME="Thinkcentre m900-hotp-maximized"
84+
export CONFIG_BOARD_NAME="Thinkcentre m900_tower-hotp-maximized"
8585
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
8686

8787
BOARD_TARGETS := m900_me_blobs

‎boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715). Mitigations and microcode updates previously applied are now known to be ineffective due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model, consider migrating to a platform with ongoing microcode support. Proper OPSEC for Memory Use MUST be followed:https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
2-
# Configuration for a m900_tiny running Qubes 4.3 and other Linux Based OSes (through kexec)
2+
# Configuration for a m900_tower running Qubes 4.3 and other Linux Based OSes (through kexec)
33
# CAVEATS:
44
# This board is vulnerable to a TPM reset attack, i.e. the PCRs are reset while the system is running.
55
# This attack can be used to bypass measured boot when an attacker succeeds at modifying the SPI flash.
@@ -8,7 +8,7 @@
88
# Make sure you understand the implications of the attack for your threat model before using this board.
99
# Includes
1010
# - Deactivated+partially neutered+deguarded ME and expanded consequent IFD BIOS regions
11-
# - More details can be found in the script under blobs/m900_tiny/m900_tiny_download_clean_deguard_me.sh
11+
# - More details can be found in the script under blobs/m900/m900_download_clean_deguard_me.sh
1212
# - Forged GBE MAC address to 00:DE:AD:C0:FF:EE
1313
# - DOES NOT INCLUDE Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
1414

@@ -79,7 +79,7 @@ export CONFIG_BOOT_REQ_HASH=n
7979
export CONFIG_BOOT_REQ_ROLLBACK=n
8080
export CONFIG_BOOT_KERNEL_ADD=""
8181
export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
82-
export CONFIG_BOARD_NAME="Thinkcentre m900-maximized"
82+
export CONFIG_BOARD_NAME="Thinkcentre m900_tower-maximized"
8383
export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
8484

8585
BOARD_TARGETS := m900_me_blobs

‎targets/m900_me_blobs.mk‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
# Targets for downloading m900 ME blob, neutering it down to BUP+ROMP region and deactivating ME.
2-
3-
# m900-*-maximized boards require of you initially call one of the
4-
# following to have gbe.bin ifd.bin and me.bin
5-
# - blobs/m900/download_clean_me.sh
6-
# To download Lenovo original ME binary, neuter+deactivate ME
2+
#
3+
# m900-*-maximized boards require you to initially call:
4+
# make blobs/m900/m900_me.bin
5+
# which runs blobs/m900/m900_download_clean_deguard_me.sh to:
6+
# 1. Download the ASRock H110M-DGS BIOS zip containing ME 11.6.0.1126
7+
# 2. Extract, partially neuter and deguard the ME firmware
8+
# 3. Place the result into blobs/m900/m900_me.bin
9+
#
10+
# The IFD (m900_tower_ifd.bin) and GBE (m900_tower_gbe.bin) blobs are
11+
# taken from a donor board and committed to the repo directly.
712

813
# Make the Coreboot build depend on the following 3rd party blobs:
914
$(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: \

0 commit comments

Comments
 (0)