smaug firmware pass: BIOS flashed, AMT disabled, RENDER_GID read - #479
Merged
Merged
Conversation
S06KT03R dated 2017-05-22 to S06KT81L dated 2024-02-05, boot block 1.03 to 1.81, by the DOS utility from a FreeDOS stick on 2026-09-16. Six and a half years of firmware, and it predated the Spectre and Meltdown microcode by a year. The timing was the point rather than the convenience. A flash resets BIOS settings, and two of this machine's are load-bearing: Configure SATA as [AHCI], because a reset to RAID puts a controller between ZFS and the disks, and CSM [Disabled], because TrueNAS is installed UEFI and would not boot with it on. Doing it with no pool and no data meant a reset cost a re-check rather than an unbootable host with a library on it. Both were re-checked; both survived. So did the machine type-model, the serial, the UUID, the MAC and the clock, none of which a Lenovo flash reliably preserves. The embedded controller did not move. It read S06CT01A before and reads S06CT01A after, and whether that package updates the component at all is unestablished — so it is recorded as an observation and not as a failure. Nothing misbehaves, the BIOS half plainly took, and inventing a diagnosis for a version string that may simply not change would be worse than saying it is unknown. The runbook's §0.1 gains a status note and keeps its procedure. The section is for the next machine and for the next time this one needs it, so it is marked done rather than deleted. Refs #413 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…is off (#413) Found on 2026-09-16 during the pre-build firmware pass, and closed the same day before the host carried anything. The MEBx accepted `admin`. That is Intel's factory default, so no ME password had ever been set on this machine — through its whole service life with whoever had it before, and through the fortnight it has been here. Manageability Feature Selection read Enabled. The ME network name and domain were both blank, which is evidence it had never been provisioned onto a network and is recorded as evidence rather than as proof, because a blank host name is not the same claim as an unprovisioned engine. Closed in the order the firmware requires and not in the order that reads best: a new ME password first, because MEBx forces one at first login; then Unconfigure Network Access → Full Unprovision WHILE the feature was still enabled, because a disabled feature cannot be unprovisioned and leaving stale provisioning behind a disabled toggle is the kind of thing that comes back; then the feature disabled. Verified by the <CTRL-P> prompt no longer being offered at boot, which is a property of the machine rather than a setting anyone reported. Disabled rather than hardened, which is the opposite of what ADR-0033 decided for shiva, and the difference is the host's job rather than a change of posture. Saruman is headless in a rack and a remote console is load-bearing there, so its iLO was kept and locked down. smaug is a tower with a monitor beside it, on the segment with the televisions and the consoles; out-of-band management buys it nothing and would cost a plane that answers when the operating system is off. The general lesson already had a home. hardware.md's CRS326 entry says a used device arrives carrying whatever its last owner left on it, users included — this is the same sentence about a different device, and the management plane is the part nobody thinks to look at. SECURITY.md's Known exposure table carries the row, in the shape the editor-undo-file finding uses: found, closed, and written down rather than quietly fixed. Refs #413 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The one value .env.example deliberately left blank, because it is a host fact and not an image one: `stat -c '%g %G' /dev/dri/renderD128` on smaug returns `107 render`. The node existing at all is worth more than the number. It means the kernel bound a driver to the P630 and exposed a render node, which is another step of ADR-0040's reopen condition standing up — after `Active Video: IGD` in the BIOS. The step it is not is a container using that node, which stays §6's to prove: the comment says so, because three-quarters of a condition met reads like a condition met if nobody writes down which quarter is missing. Getting this wrong never fails loudly. Jellyfin falls back to software transcoding and one 4K stream saturates the box, which presents as "the film stutters" rather than as an error. Refs #138 #413 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Gerrrt
changed the title
The static is set, the Kea reservation is in, and the inbound rules exist. That fires three obligations this repository wrote down in advance, and they are the substance of this commit rather than a tidy-up after it. ADR-0016 said: "README.md and security.md both say the media segment is 'egress only, no path to anything else'. That sentence becomes wrong for CasaBonita on the day the first rule is created ... it is edited when the rules exist, not now." The rules exist. Both now distinguish the direction the ADR's own title turns on — terminal OUTWARD, which is unchanged and still true of all three guest segments, from inbound, where CasaBonita is now the single exception and reachable by two more-trusted segments to one host on named ports. The TS150 entry in hardware.md set its own promotion trigger — "it enters the Compute table when it is racked, or rather placed, addressed and in network.md" — and that trigger has fired. The Storage column reads the boot disk alone on purpose: the mirror does not exist until the Exos drives land, and describing a pool nobody has created is the kind of claim that table exists to not make. network.md gains the host row and loses "not yet built". Its Reaches column does NOT change, which ADR-0016 also predicted: nothing on CasaBonita initiates anywhere, and all four passes let a more trusted segment reach in. Verified from morpheus rather than from the UI, because position is what goes wrong with pf and an appended rule matches nothing while looking present. Every pass sits above Block access to CasaBonita on its interface: 167-168 before 169 on igc0.99, 194-195 before 196 on igc0.50. The negative test passes too — Winterfell is still refused on 443, so the Winterfell rule is as narrow as it reads rather than wider. And the #223 tripwire on igc0.40 reads 118,621 evaluations and zero packets, which is the check ADR-0016 named. Four rules rather than three: the Hicks pass is split into 443 and 8096 instead of one rule with a port list. Functionally identical, and the rule descriptions read better for it. One wording change was forced by a checker and is worth recording because the same trap is waiting for three other rows. count_alloy_agents counts any architecture.md row whose Contents cell contains "alloy" and is not marked not built. The row first said "No Alloy agent", which that heuristic cannot distinguish from having one, and the count went to five. Reworded to say the same thing without the word. bahamut, leviathan and titan all say "runs no Alloy" today and are only safe because they are still marked not built. Refs #413 #223 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three pre-build firmware items on
smaug, all done before the pool exists andbefore the host carries anything.
1. BIOS flashed
S06KT03R(2017-05-22) →S06KT81L(2024-02-05), boot block1.03→1.81, by the DOS utility from a FreeDOS stick.The timing was the point, not the convenience. A flash resets BIOS
settings, and two of this machine's are load-bearing:
Configure SATA as [AHCI], because a reset to RAID puts a controller between ZFS and the disks,and
CSM [Disabled], because TrueNAS is installed UEFI and would not boot withit on. With no pool and no data, a reset cost a re-check rather than an
unbootable host with a library on it. Both survived, as did the machine
type-model, serial, UUID, MAC and clock.
The embedded controller did not move —
S06CT01Abefore and after.Recorded as an observation, not a failure: whether that package updates the
component at all is unestablished, and inventing a diagnosis for a version
string that may simply not change would be worse than saying it is unknown.
2. AMT was on its factory-default credential, and is now off
The MEBx accepted
admin. Intel's default — so no ME password had everbeen set, through this machine's whole service life with whoever had it before.
Manageability Feature SelectionreadEnabled. ME network name and domainwere blank, which is evidence it had never been provisioned and is recorded
as evidence rather than proof.
Closed in the order the firmware requires rather than the order that reads
best: a new ME password (MEBx forces one), then
Unconfigure Network Access→Full Unprovisionwhile the feature was still enabled — a disabled featurecannot be unprovisioned, and stale provisioning behind a disabled toggle is the
kind of thing that comes back — then the feature disabled. Verified by the
<CTRL-P>prompt no longer being offered at boot.Disabled rather than hardened, the opposite of ADR-0033 for
shiva, andthe difference is the host's job rather than a change of posture:
Sarumanisheadless in a rack where a remote console earns its keep;
smaugis a towerwith a monitor beside it on the segment with the televisions.
The general lesson already had a home —
hardware.md's CRS326 entry says aused device arrives carrying whatever its last owner left on it. Same sentence,
different device, and the management plane is the part nobody thinks to look
at.
3.
RENDER_GIDfilled in107 render, read off the host. The node existing at all matters more than thenumber: the kernel bound a driver to the P630 and exposed a render node, which
is another step of ADR-0040's reopen condition standing up after
Active Video: IGD. The step it is not is a container using that node — stillbuild-the-nas.md§6's to prove, and the comment says so, becausethree-quarters of a condition met reads like a condition met if nobody writes
down which quarter is missing.
make validatepasses;check_docsgreen at 10 assertions.mainis mergedin rather than rebased; #478 landed mid-write.
Refs #413 #138
🤖 Generated with Claude Code