m900 tower port + TPM1 auth/defend lock fixes by tlaurion · Pull Request #2118 · linuxboot/heads

tlaurion · 2026-05-14T19:52:33Z

Superseeds #2111 rebased on #2117 (which was rebased on master)

Merges the m900 tower board port (notgivenby) with TPM1 auth failure
detection and defend lock recovery.

Board port (notgivenby's commits):

Board configs for m900 tower (maximized and hotp-maximized variants)
Coreboot config, linux config, ME blob handling
Review comments addressed: typos, blob names, board name includes 'tower'

TPM1 fixes (tpmr.sh):

Auth detection grep patterns now catch 'defend lock' (TPM_DEFEND_LOCK_RUNNING)
tpm1_reset: physical disable/enable cycle to clear defend lock, retry takeown
Doc/tpm.md updated with accurate auth patterns

@notgivenby so you can test artifacts. Fixed comments #2111.

Feel free to pick comments, steal, reuse reword.

Copilot

Pull request overview

This PR ports the Lenovo M900 Tower (Skylake/Kaby Lake LGA1151 mini-tower) to Heads with two board variants (maximized, hotp-maximized), plus targeted TPM1 reliability fixes in tpmr.sh so that auth-failure detection and tpm1_reset() recover from the TPM_DEFEND_LOCK_RUNNING state after multiple bad passphrases. Documentation in doc/tpm.md is expanded with TPM1 vs TPM2 error-stream conventions, auth grep patterns, and the defend-lock recovery flow.

Changes:

New EOL_m900_tower-{maximized,hotp-maximized} boards with shared coreboot/linux configs and an ME blob preparation pipeline (download → me_cleaner → deguard).
TPM1 auth grep patterns extended to include defend/0x98e/0x149; tpm1_reset() cycles physical presence on defend lock running after forceclear.
CircleCI: two new build jobs (depend on the existing EOL_t480-hotp-maximized 25.09 seed).

Reviewed changes

Copilot reviewed 10 out of 14 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
boards/EOL_m900_tower-maximized/EOL_m900_tower-maximized.config	New maximized board config (no HOTP).
boards/EOL_m900_tower-hotp-maximized/EOL_m900_tower-hotp-maximized.config	New hotp-maximized variant.
config/coreboot-m900-maximized.config	Coreboot 25.09 config for Lenovo M900.
config/linux-m900.config	Linux 6.1.8 kernel config for the board.
targets/m900_me_blobs.mk	Make rules tying the ME blob script into the board build.
blobs/m900/m900_download_clean_deguard_me.sh	Downloads ASRock BIOS, neuters/deguards ME 11.6.0.1126.
blobs/m900/README.md	Blob layout, sources and integrity notes.
blobs/m900/hashes.txt	SHA256 of ME/IFD/GBE blobs.
blobs/m900/.gitignore	Ignores generated `me.bin`/`m900_me.bin`.
initrd/bin/tpmr.sh	Adds defend-lock detection in auth-retry grep and `tpm1_reset()` recovery sequence.
doc/tpm.md	New sections on TPM1/TPM2 auth error patterns and defend-lock recovery.
.circleci/config.yml	Adds the two M900 board build jobs (depending on the 25.09 seed).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 10 out of 14 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 10 out of 14 changed files in this pull request and generated no new comments.

…ecovery TPM1 auth errors from tpmtotp use TPM_GetErrMsg() which returns English strings ('Authentication failed (Incorrect Password)', 'Defend lock running') — but the grep patterns lacked 'defend', causing defend lock to be treated as a non-auth error (DIE instead of retry). - Add 'defend' to all auth detection grep patterns (catches TPM_DEFEND_LOCK_RUNNING) - tpm1_reset: detect 'defend lock' after forceclear, cycle physical presence (disable/enable) to clear the lock, retry takeown Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

…900_tower board Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

- blobs/m900/README.md: fix blob filenames, spelling (paritally->partially, Unfourtunatly->Unfortunately, layot->layout) - blobs/m900/m900_download_clean_deguard_me.sh: fix Dell->ASRock comment - boards/EOL_m900_tower-*: fix m900_tiny->m900_tower, fix ME script path, add 'tower' to CONFIG_BOARD_NAME - targets/m900_me_blobs.mk: rewrite header with accurate instructions Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Copilot

Pull request overview

Copilot reviewed 10 out of 14 changed files in this pull request and generated no new comments.

Copilot AI review requested due to automatic review settings May 14, 2026 19:52

Copilot started reviewing on behalf of tlaurion May 14, 2026 19:53 View session

Copilot AI reviewed May 14, 2026

View reviewed changes

Comment thread blobs/m900/m900_download_clean_deguard_me.sh

Comment thread doc/tpm.md Outdated

Comment thread doc/tpm.md

Comment thread blobs/m900/README.md Outdated

Comment thread blobs/m900/README.md Outdated

tlaurion force-pushed the m900_with_tpm1_fixes branch 2 times, most recently from 78366db to a9cd1fc Compare May 14, 2026 20:13

tlaurion requested a review from Copilot May 14, 2026 20:18

Copilot started reviewing on behalf of tlaurion May 14, 2026 20:18 View session

Copilot AI reviewed May 14, 2026

View reviewed changes

Comment thread blobs/m900/m900_download_clean_deguard_me.sh Outdated

Comment thread blobs/m900/m900_download_clean_deguard_me.sh

Comment thread blobs/m900/README.md Outdated

Comment thread blobs/m900/hashes.txt

Comment thread blobs/m900/.gitignore Outdated

tlaurion force-pushed the m900_with_tpm1_fixes branch from a9cd1fc to d8d7665 Compare May 14, 2026 20:23

tlaurion requested a review from Copilot May 14, 2026 20:24

Copilot started reviewing on behalf of tlaurion May 14, 2026 20:25 View session

Copilot AI reviewed May 14, 2026

View reviewed changes

tlaurion force-pushed the m900_with_tpm1_fixes branch 2 times, most recently from 11e9506 to 863c9b7 Compare May 14, 2026 20:42

tlaurion and others added 14 commits May 14, 2026 16:50

add m900_tower board

d147c2b

Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

add the script to download, deguard and reduce the intel ME blob

aa0015e

Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

add ifd and gbe blobs for the m900_tower board

afb8c31

Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

add m900_tower board information including caveats

90aeafa

Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

add hashes of the blobs and .gitignore file

a150ccb

Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

add the .gitignore file

2926342

Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

add the board config for m900_tower hotp variant

1205548

Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

add the board config for m900_tower maximized variant

a3214d3

Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

add the coreboot config for m900_tower board

d45181e

Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

add target mk file to download, deguard, and reduce the ME blob for m…

e160370

…900_tower board Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

add the linux config for the m900_tower board

b3d44ea

Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

add m900 hotp and maximized into circle ci

94bbbbf

Signed-off-by: notgivenby <notgivenby@gmail.com> Signed-off-by: Thierry Laurion <insurgo@riseup.net>

tlaurion force-pushed the m900_with_tpm1_fixes branch from 863c9b7 to 6919d44 Compare May 14, 2026 20:52

tlaurion requested a review from Copilot May 14, 2026 20:53

Copilot started reviewing on behalf of tlaurion May 14, 2026 20:53 View session

Copilot AI reviewed May 14, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

m900 tower port + TPM1 auth/defend lock fixes#2118

m900 tower port + TPM1 auth/defend lock fixes#2118
tlaurion wants to merge 14 commits into
masterfrom
m900_with_tpm1_fixes

tlaurion commented May 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

tlaurion commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tlaurion commented May 14, 2026 •

edited

Loading