T550 Bootguard Check

[lebakassemmerl]

Hi!

I ran your script and got the following (not very promising) output on my T550 Thinkpad:

CPU-Infos:

user@intelmetool$ lscpu
Architektur:                       x86_64
  CPU Operationsmodus:             32-bit, 64-bit
  Adressgrößen:                    39 bits physical, 48 bits virtual
  Byte-Reihenfolge:                Little Endian
CPU(s):                            4
  Liste der Online-CPU(s):         0-3
Anbieterkennung:                   GenuineIntel
  Modellname:                      Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz
    Prozessorfamilie:              6
    Modell:                        61
    Thread(s) pro Kern:            2
    Kern(e) pro Sockel:            2
    Sockel:                        1
    Stepping:                      4
    Skalierung der CPU(s):         85%
    Maximale Taktfrequenz der CPU: 2700,0000
    Minimale Taktfrequenz der CPU: 500,0000
    BogoMIPS:                      4389,60
    Markierungen:                  fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush d
                                   ts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc 
                                   arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pc
                                   lmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4
                                   _1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_l
                                   m abm 3dnowprefetch cpuid_fault epb pti ssbd ibrs ibpb stibp tpr_shadow flexprior
                                   ity ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdseed a
                                   dx smap intel_pt xsaveopt dtherm ida arat pln pts vnmi md_clear flush_l1d
Virtualisierungsfunktionen:        
  Virtualisierung:                 VT-x
Caches (Gesamtsumme):              
  L1d:                             64 KiB (2 Instanzen)
  L1i:                             64 KiB (2 Instanzen)
  L2:                              512 KiB (2 Instanzen)
  L3:                              3 MiB (1 Instanz)
NUMA:                              
  NUMA-Knoten:                     1
  NUMA-Knoten0 CPU(s):             0-3
Schwachstellen:                    
  Gather data sampling:            Not affected
  Ghostwrite:                      Not affected
  Indirect target selection:       Not affected
  Itlb multihit:                   KVM: Mitigation: Split huge pages
  L1tf:                            Mitigation; PTE Inversion; VMX conditional cache flushes, SMT vulnerable
  Mds:                             Mitigation; Clear CPU buffers; SMT vulnerable
  Meltdown:                        Mitigation; PTI
  Mmio stale data:                 Unknown: No mitigations
  Reg file data sampling:          Not affected
  Retbleed:                        Not affected
  Spec rstack overflow:            Not affected
  Spec store bypass:               Mitigation; Speculative Store Bypass disabled via prctl
  Spectre v1:                      Mitigation; usercopy/swapgs barriers and __user pointer sanitization
  Spectre v2:                      Mitigation; Retpolines; IBPB conditional; IBRS_FW; STIBP conditional; RSB filling
                                   ; PBRSB-eIBRS Not affected; BHI Not affected
  Srbds:                           Mitigation; Microcode
  Tsx async abort:                 Not affected

Intel ME infos / ouptut of your script:

user@intelmetool$ sudo lsmod | grep msr
intel_rapl_msr         20480  0
intel_rapl_common      53248  1 intel_rapl_msr

user@intelmetool$ sudo ./intelmetool -b
Bad news, you have a `Wildcat Point-LP LPC Controller` so you have ME hardware on board and you can't control or disable it, continuing...

MEI found: [8086:9cba] Wildcat Point-LP MEI Controller #1

ME Status   : 0x1e000245
ME Status 2 : 0x6900a306

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : YES
ME: Manufacturing Mode      : NO
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Normal
ME: Current Operation State : M0 with UMA
ME: Current Operation Mode  : Normal
ME: Error Code              : No Error
ME: Progress Phase          : Host Communication
ME: Power Management Event  : Non-power cycle reset
ME: Progress Phase State    : Host communication established

ME: Extend SHA-256: b9bec4b85de384773cd609104ddedb768bbfcbe8601fde0e20d48d25151e9ddf

ME: timeout waiting for data: expected 8, available 0
ME: GET FW VERSION message failed
Bad news, you have a `Wildcat Point-LP LPC Controller` so you have ME hardware on board and you can't control or disable it, continuing...

Boot Guard MSR Output : 0x300000051
Measured boot        : OFF
Verified boot        : ON
FACB in FPFs         : ON
Module revoked       : OFF
NEM enabled          : ON
Verified boot is enabled and ACM has enabled Cache-As-RAM.
You can't flash other firmware!

I hope this helps in some way. If you need any additional infos about my setup, please let me know.