GbE-region Mac randomisation - #2207
Open
tlaurion wants to merge 7 commits into
Open
Conversation
- nvmutil from libreboot added as a module - ifdtool from coreboot is included as a part of the Makefile Signed-off-by: Rene <chaotic@disroot.org>
- Ethernet MAC address randomization - menu option is displayed only if $CONFIG_NVMUTIL=y and $CONFIG_IFDTOOL=y are set in the config file - add mac_randomization_options_menu() - to select a completely random mac, an intel pattern or to show the current mac Signed-off-by: Rene <chaotic@disroot.org>
- add show_mac - add change_mac - add clean_up_mac, remove temporary files - adjust CONFIG_FLASH_OPTIONS in flash.sh, for mac randomization Signed-off-by: Rene <chaotic@disroot.org>
- add $CONFIG_NVMUTIL - add $CONFIG_IFDTOOL - change $CONFIG_FLASH_OPTIONS to "flashprog --progress --programmer internal --ifd -i bios -i me -i fd" for all boards have GBE packed in ROM - t420 and x220, tools are set to no, does not fit in 7mb image (like dropbear) Signed-off-by: Rene <chaotic@disroot.org>
gbe_only writes only the IFD, Flash Descriptor (fd), and GbE regions. Its temp .rom has no BIOS-region CBFS for preserve_rom to inject into, so on region-limited writes the flash dispatcher skips preserve_rom and serial_number persistence entirely. Board name matching uses POSIX case + glob (*librem_l1um excludes _v2; *talos-2* catches UNTESTED_ and EOL_ prefixes). Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Covers flash paths (whole-chip vs region-limited vs reserved whole_spi), runtime configuration preservation (the two gates that must both hold), CBFS injection semantics (the list-returns-empty- but-add-fails signature that gates the preservation step), MAC randomization flow, and a brief note on board-name conventions. Signed-off-by: Thierry Laurion <insurgo@riseup.net>
There was a problem hiding this comment.
🔵 Needs a closer look
It changes firmware flashing and protected-region handling across many board configurations and has unresolved review findings.
Pull request overview
Adds fast GbE MAC inspection and randomization using nvmutil and ifdtool, with GUI workflows, region-aware flashing, and board configuration updates.
Changes:
- Packages
nvmutilandifdtool. - Adds MAC viewing and randomization workflows.
- Updates flashing behavior, documentation, and supported board configurations.
File summaries
| File | Change summary | Final review note |
|---|---|---|
modules/nvmutil |
Defines the pinned nvmutil build. |
— |
Makefile |
Builds and stages nvmutil and ifdtool. |
— |
initrd/etc/functions.sh |
Implements MAC reading, randomization, flashing, and cleanup. | Moderate (2 votes): Report failures for the descriptor/FD/GbE read rather than “Unable to read BIOS”. |
initrd/bin/gui-init.sh |
Adds MAC-management menus. | Nit (3 votes): Correct the label to “an Intel-based” and “Ethernet”. |
initrd/bin/flash.sh |
Adds region-specific flash dispatch. | — |
initrd/bin/flash-gui.sh |
Updates Talos board matching. | — |
doc/flash-concepts.md |
Documents flash-region behavior and the MAC workflow. | Nit (3 votes): Describe gbe_only as including descriptor/FD/GbE regions, not only GbE bytes, and state that other regions remain byte-identical. Nit (1 vote): Describe default flashing as board-configured region selection, not a whole-chip rewrite. |
boards/novacustom-v560tu/novacustom-v560tu.config |
Enables MAC tools and region-aware flashing. | — |
boards/novacustom-v540tu/novacustom-v540tu.config |
Enables MAC tools and region-aware flashing. | — |
boards/kano/kano.config |
Separates flash tool and options. | Moderate (1 vote): Keep Kano’s previous --ifd -i bios -i fd selection; adding -i me can target its protected ME region. |
boards/kano-hotp/kano-hotp.config |
Separates flash tool and options. | — |
boards/EOL_z220-cmt-maximized/EOL_z220-cmt-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_z220-cmt-hotp-maximized/EOL_z220-cmt-hotp-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_x280-maximized/EOL_x280-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_x280-hotp-maximized/EOL_x280-hotp-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_x230-maximized/EOL_x230-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_x230-maximized-fhd_edp/EOL_x230-maximized-fhd_edp.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_x230-hotp-maximized-fhd_edp/EOL_x230-hotp-maximized-fhd_edp.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_x230-hotp-maximized_usb-kb/EOL_x230-hotp-maximized_usb-kb.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_x220-maximized/EOL_x220-maximized.config |
Preserves GbE while keeping MAC tools disabled. | — |
boards/EOL_x220-hotp-maximized/EOL_x220-hotp-maximized.config |
Preserves GbE while keeping MAC tools disabled. | — |
boards/EOL_w541-maximized/EOL_w541-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_w541-hotp-maximized/EOL_w541-hotp-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_w530-maximized/EOL_w530-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_w530-hotp-maximized/EOL_w530-hotp-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_UNTESTED_t530-maximized/EOL_UNTESTED_t530-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_UNTESTED_t530-hotp-maximized/EOL_UNTESTED_t530-hotp-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_t480s-maximized/EOL_t480s-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_t480s-hotp-maximized/EOL_t480s-hotp-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_t480-maximized/EOL_t480-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_t440p-maximized/EOL_t440p-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_t440p-hotp-maximized/EOL_t440p-hotp-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_t430-maximized/EOL_t430-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_t430-hotp-maximized/EOL_t430-hotp-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_t420-maximized/EOL_t420-maximized.config |
Preserves GbE while keeping MAC tools disabled. | — |
boards/EOL_t420-hotp-maximized/EOL_t420-hotp-maximized.config |
Preserves GbE while keeping MAC tools disabled. | — |
boards/EOL_optiplex-7010_9010-maximized/EOL_optiplex-7010_9010-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_optiplex-7010_9010-hotp-maximized/EOL_optiplex-7010_9010-hotp-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_optiplex-7010_9010_TXT-maximized/EOL_optiplex-7010_9010_TXT-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_optiplex-7010_9010_TXT-hotp-maximized/EOL_optiplex-7010_9010_TXT-hotp-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config |
Enables MAC tools and region-aware flashing. | — |
boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config |
Enables MAC tools and region-aware flashing. | — |
Review details
Suppressed comments (2)
boards/kano/kano.config:86
- Kano explicitly enables
CONFIG_COREBOOT_GPR0_DISABLE=yand documents that the ME region stays read-only. Adding-i meto the normal flash command now asks flashprog to write that protected region, so regular BIOS updates can fail; keep Kano's previous--ifd -i bios -i fdselection and only add the separate tool variable.
doc/flash-concepts.md:14 - This describes the default path as a whole-chip rewrite, but the board configurations changed in this PR set
CONFIG_FLASH_OPTIONSto--ifd -i bios -i me -i fd, so the default flash excludes GbE and is not a whole-chip write. Please document the default as board-configured region selection to avoid misleading maintainers about which regions a normal firmware update overwrites.
- Files reviewed: 41/44 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
|
||
| # test if file is > 0 byte | ||
| if [ ! -s /tmp/${CONFIG_BOARD}.rom ]; then | ||
| whiptail_error --title 'ERROR' --msgbox "Unable to read BIOS" 0 80 |
Comment on lines
+62
to
+63
| The write touches only the GbE region. The rest of the chip stays | ||
| byte-identical. Confirmation gates the write. Any failure funnels to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
3 commits on top of #2171
changes: taking a rom dump of --ifd -i fd -i gbe is sufficient for ifdtool to extract gbe and act upon it. This makes GBE randomization basically instantaneous.
cc @FckBigTch: Please review!