T480/T480S: Support fetching ThunderBolt firmware

Though not used in coreboot builds, and not injected into the
builds in any way, these files are now created seperately when
handling T480/T480s vendor files:

vendorfiles/t480/tb.bin
vendorfiles/t480s/tb.bin

These are created by extracting Lenovo's ThunderBolt firmware
from update files. The updated firmware fixes a bug; older firmware
enabled debug commands that wrote logs to the TB controller's
own flash IC, and it'd get full up with logs, bricking the controller.
If you've already been screwed by this, you must flash externally,
using a padded firmware from Lenovo's updates.

Lenovo's own updater requires creating a boot CD or booting
Windows. This patch in lbmk auto-downloads just the firmware,
and you can flash it externally.

You could simply do this as a matter of course, when installing
Libreboot. You are recommended to update the Lenovo UEFI/EC firmwares
first, before installing Libreboot; please look at the Libreboot
documentation to know exactly which versions.

Then dump the ThunderBolt firmware first, to be sure, and then you
can flash these files. Flashing these updates will prevent the bug
described here:

https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t480-type-20l5-20l6/20l5/solutions/ht508988

You can download Lenovo's installers for various ThinkPad models
there, including T480s/T480s. It is these downloads that this lbmk
patch uses, to extract those files directly.

Signed-off-by: Leah Rowe <leah@libreboot.org>

8 files changed, 127 insertions, 4 deletions

diff --git a/config/coreboot/next/patches/0011-lenovo-Add-Kconfig-option-CONFIG_LENOVO_TBFW_BIN.patch b/config/coreboot/next/patches/0011-lenovo-Add-Kconfig-option-CONFIG_LENOVO_TBFW_BIN.patch
new file mode 100644
index 00000000..542b6608
--- /dev/null
+++ b/config/coreboot/next/patches/0011-lenovo-Add-Kconfig-option-CONFIG_LENOVO_TBFW_BIN.patch
@@ -0,0 +1,78 @@
+From 91c7d772f4803a94950b3224ccd11ffd162b4e36 Mon Sep 17 00:00:00 2001
+From: Leah Rowe <info@minifree.org>
+Date: Wed, 18 Dec 2024 02:06:18 +0000
+Subject: [PATCH 1/1] lenovo: Add Kconfig option CONFIG_LENOVO_TBFW_BIN
+
+This is used by lbmk to know where a tb.bin file goes,
+when extracting and padding TBT.bin from Lenovo ThunderBolt
+firmware updates on T480/T480s and other machines, grabbing
+Lenovo update files.
+
+Not used in any builds, so it's not relevant for ./mk inject
+
+However, the ThunderBolt firmware is now auto-downloaded on
+T480/T480s. This is not inserted, because it doesn't go in
+the main flash, but the resulting ROM image can be flashed
+on the TB controller's separate flash chip.
+
+Locations are as follows:
+
+vendorfiles/t480s/tb.bin
+vendorfiles/t480/tb.bin
+
+This can be used for other affected ThinkPads when they're
+added to Libreboot, but note that Lenovo provides different
+TB firmware files for each machine.
+
+Since I assume it's the same TB controller on all of those
+machines, I have to wonder: what difference is there between
+the various TBT.bin files provided by Lenovo, and how do they
+differ in terms of actual flashed configuration?
+
+We simply flash the padded TBT.bin when updating the firmware,
+flashing externally. That's what this patch is for, so that
+lbmk can auto-download them.
+
+Signed-off-by: Leah Rowe <info@minifree.org>
+---
+ src/mainboard/lenovo/Kconfig | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/src/mainboard/lenovo/Kconfig b/src/mainboard/lenovo/Kconfig
+index 2ffbaab85f..512b326381 100644
+--- a/src/mainboard/lenovo/Kconfig
++++ b/src/mainboard/lenovo/Kconfig
+@@ -18,4 +18,30 @@ config MAINBOARD_FAMILY
+ 	string
+ 	default MAINBOARD_PART_NUMBER
+ 
++config LENOVO_TBFW_BIN
++	string "Lenovo ThunderBolt firmware bin file"
++	default ""
++	help
++	  ThunderBolt firmware for certain ThinkPad models e.g. T480.
++	  Not used in the actual build. Libreboot's build system uses this
++	  along with config/vendor/*/pkg.cfg entries defining a URL to the
++	  Lenovo download link and hash. The resulting file when processed by
++	  lbmk can be flashed to the ThunderBolt firmware's 25XX NOR device.
++	  Earlier versions of this firmware had debug commands enabled that
++	  sent logs to said flash IC, and it would quickly fill up, bricking
++	  the ThunderBolt controller. With these updates, flashed externally,
++	  you can fix the issue if present or otherwise prevent it. The benefit
++	  here is that you then don't need to use Windows or a boot disk. You
++	  can flash the TB firmware while flashing Libreboot firmware. Easy!
++	  Look for these variables in lbmk:
++	  TBFW_url TBFW_url_bkup TBFW_hash and look at how it handles that and
++	  CONFIG_LENOVO_TBFW_BIN, in lbmk's include/vendor.sh file.
++	  The path set by CONFIG_LENOVO_TBFW_BIN is used by lbmk when extracting
++	  the firmware, putting it at that desired location. In this way, lbmk
++	  can auto-download such firmware. E.g. ./mk -d coreboot t480_fsp_16mb
++	  and it appears at vendorfiles/t480/tb.bin fully padded and everything!
++
++	  Just leave this blank if you don't care about this option. It's not
++	  useful for every ThinkPad, only certain models.
++
+ endif # VENDOR_LENOVO
+-- 
+2.39.5
+
diff --git a/config/coreboot/t480_fsp_16mb/config/libgfxinit_corebootfb b/config/coreboot/t480_fsp_16mb/config/libgfxinit_corebootfb
index 769d53eb..c4550f1d 100644
--- a/config/coreboot/t480_fsp_16mb/config/libgfxinit_corebootfb
+++ b/config/coreboot/t480_fsp_16mb/config/libgfxinit_corebootfb
@@ -218,6 +218,7 @@ CONFIG_PS2M_EISAID="PNP0F13"
 CONFIG_THINKPADEC_HKEY_EISAID="IBM0068"
 CONFIG_GFX_GMA_PANEL_1_PORT="eDP"
 CONFIG_BOARD_LENOVO_SKLKBL_THINKPAD_COMMON=y
+CONFIG_LENOVO_TBFW_BIN="../../../vendorfiles/t480/tb.bin"
 # CONFIG_SOC_INTEL_CSE_SEND_EOP_EARLY is not set
 CONFIG_TTYS0_BAUD=115200
 CONFIG_POWER_STATE_DEFAULT_ON_AFTER_FAILURE=y
diff --git a/config/coreboot/t480_fsp_16mb/config/libgfxinit_txtmode b/config/coreboot/t480_fsp_16mb/config/libgfxinit_txtmode
index e21749fe..83a8ecd6 100644
--- a/config/coreboot/t480_fsp_16mb/config/libgfxinit_txtmode
+++ b/config/coreboot/t480_fsp_16mb/config/libgfxinit_txtmode
@@ -216,6 +216,7 @@ CONFIG_PS2M_EISAID="PNP0F13"
 CONFIG_THINKPADEC_HKEY_EISAID="IBM0068"
 CONFIG_GFX_GMA_PANEL_1_PORT="eDP"
 CONFIG_BOARD_LENOVO_SKLKBL_THINKPAD_COMMON=y
+CONFIG_LENOVO_TBFW_BIN="../../../vendorfiles/t480/tb.bin"
 # CONFIG_SOC_INTEL_CSE_SEND_EOP_EARLY is not set
 CONFIG_TTYS0_BAUD=115200
 CONFIG_POWER_STATE_DEFAULT_ON_AFTER_FAILURE=y
diff --git a/config/coreboot/t480s_fsp_16mb/config/libgfxinit_corebootfb b/config/coreboot/t480s_fsp_16mb/config/libgfxinit_corebootfb
index 9eb3bf31..2e29a0a7 100644
--- a/config/coreboot/t480s_fsp_16mb/config/libgfxinit_corebootfb
+++ b/config/coreboot/t480s_fsp_16mb/config/libgfxinit_corebootfb
@@ -218,6 +218,7 @@ CONFIG_PS2M_EISAID="PNP0F13"
 CONFIG_THINKPADEC_HKEY_EISAID="IBM0068"
 CONFIG_GFX_GMA_PANEL_1_PORT="eDP"
 CONFIG_BOARD_LENOVO_SKLKBL_THINKPAD_COMMON=y
+CONFIG_LENOVO_TBFW_BIN="../../../vendorfiles/t480s/tb.bin"
 # CONFIG_SOC_INTEL_CSE_SEND_EOP_EARLY is not set
 CONFIG_TTYS0_BAUD=115200
 CONFIG_POWER_STATE_DEFAULT_ON_AFTER_FAILURE=y
diff --git a/config/coreboot/t480s_fsp_16mb/config/libgfxinit_txtmode b/config/coreboot/t480s_fsp_16mb/config/libgfxinit_txtmode
index 9bd3bcdd..84ac6177 100644
--- a/config/coreboot/t480s_fsp_16mb/config/libgfxinit_txtmode
+++ b/config/coreboot/t480s_fsp_16mb/config/libgfxinit_txtmode
@@ -216,6 +216,7 @@ CONFIG_PS2M_EISAID="PNP0F13"
 CONFIG_THINKPADEC_HKEY_EISAID="IBM0068"
 CONFIG_GFX_GMA_PANEL_1_PORT="eDP"
 CONFIG_BOARD_LENOVO_SKLKBL_THINKPAD_COMMON=y
+CONFIG_LENOVO_TBFW_BIN="../../../vendorfiles/t480s/tb.bin"
 # CONFIG_SOC_INTEL_CSE_SEND_EOP_EARLY is not set
 CONFIG_TTYS0_BAUD=115200
 CONFIG_POWER_STATE_DEFAULT_ON_AFTER_FAILURE=y
diff --git a/config/vendor/t480/pkg.cfg b/config/vendor/t480/pkg.cfg
index 0088b2b5..59280a8a 100644
--- a/config/vendor/t480/pkg.cfg
+++ b/config/vendor/t480/pkg.cfg
@@ -1,3 +1,4 @@
+# ME firmware (deguard will be used)
 DL_hash="df735a24242792bf4150f30bf0bd4fdbdc0fb6bf0f897ea533df32567be8e084006d692fb6351677f8cc976878c5018667901dbd407b0a77805754f7c101497c"
 DL_url="https://dl.dell.com/FOLDER04573471M/1/Inspiron_5468_1.3.0.exe"
 DL_url_bkup="https://web.archive.org/web/20241110222323/https://dl.dell.com/FOLDER04573471M/1/Inspiron_5468_1.3.0.exe"
@@ -8,3 +9,11 @@ ME11delta="thinkpad_t480" # subdirectory under deguard's data/delta/
 ME11version="11.6.0.1126"
 ME11sku="2M"
 ME11pch="LP"
+
+# ThunderBolt firmware
+# (flashed on the 1MB chip, not main 16MB; not used by coreboot)
+# (padded firmware will appear at vendorfiles/t480/tb.bin)
+# 
+TBFW_url="https://download.lenovo.com/pccbbs/mobiles/n24th13w.exe"
+TBFW_url_bkup="https://web.archive.org/web/20241004165955/https://download.lenovo.com/pccbbs/mobiles/n24th13w.exe"
+TBFW_hash="906d916e8ae77e6d146c67c3113cd904e735a7f28cb2fc37e2284758ead5cda8dd4025c1c741fac9162b1eb01cff08fc39a0d4e79c5cec0515f1d3e6447d1323"
diff --git a/config/vendor/t480s/pkg.cfg b/config/vendor/t480s/pkg.cfg
index 67f000da..bbe2c5e9 100644
--- a/config/vendor/t480s/pkg.cfg
+++ b/config/vendor/t480s/pkg.cfg
@@ -8,3 +8,11 @@ ME11delta="thinkpad_t480s" # subdirectory under deguard's data/delta/
 ME11version="11.6.0.1126"
 ME11sku="2M"
 ME11pch="LP"
+
+# ThunderBolt firmware
+# (flashed on the 1MB chip, not main 16MB; not used by coreboot)
+# (padded firmware will appear at vendorfiles/t480s/tb.bin)
+# 
+TBFW_url="https://download.lenovo.com/pccbbs/mobiles/n22th11w.exe"
+TBFW_url_bkup="https://web.archive.org/web/20230319003752/https://download.lenovo.com/pccbbs/mobiles/n22th11w.exe"
+TBFW_hash="ef8ec0a41d7faaa0ce514cfb6f8e7e10669c878eff69fbe1b821443b6218f5b31e1b910c8abceecf38d4b11a6e552d90f277c96c7a9c512d605c8b8aea9c1c0c"
diff --git a/include/vendor.sh b/include/vendor.sh
index 3f78c368..b1f47d6d 100644
--- a/include/vendor.sh
+++ b/include/vendor.sh
@@ -16,7 +16,8 @@ cv="CONFIG_HAVE_ME_BIN CONFIG_ME_BIN_PATH CONFIG_INCLUDE_SMSC_SCH5545_EC_FW \
     CONFIG_KBC1126_FW2 CONFIG_KBC1126_FW1_OFFSET CONFIG_KBC1126_FW2_OFFSET \
     CONFIG_VGA_BIOS_FILE CONFIG_VGA_BIOS_ID CONFIG_BOARD_DELL_E6400 \
     CONFIG_HAVE_MRC CONFIG_MRC_FILE CONFIG_HAVE_REFCODE_BLOB \
-    CONFIG_REFCODE_BLOB_FILE CONFIG_GBE_BIN_PATH CONFIG_IFD_BIN_PATH"
+    CONFIG_REFCODE_BLOB_FILE CONFIG_GBE_BIN_PATH CONFIG_IFD_BIN_PATH \
+    CONFIG_LENOVO_TBFW_BIN"
 
 eval `setvars "" EC_url_bkup EC_hash DL_hash DL_url_bkup MRC_refcode_gbe vcfg \
     E6400_VGA_DL_hash E6400_VGA_DL_url E6400_VGA_DL_url_bkup E6400_VGA_offset \
@@ -24,7 +25,8 @@ eval `setvars "" EC_url_bkup EC_hash DL_hash DL_url_bkup MRC_refcode_gbe vcfg \
     mecleaner kbc1126_ec_dump MRC_refcode_cbtree new_mac _dl SCH5545EC_DL_url \
     archive EC_url boarddir rom cbdir DL_url nukemode cbfstoolref vrelease \
     verify _7ztest ME11bootguard ME11delta ME11version ME11sku ME11pch \
-    IFD_platform ifdprefix cdir sdir _me _metmp mfs $cv`
+    IFD_platform ifdprefix cdir sdir _me _metmp mfs TBFW_url_bkup TBFW_url \
+    TBFW_hash $cv`
 
 vendor_download()
 {
@@ -52,7 +54,8 @@ readkconfig()
 	eval `setcfg "$TMPDIR/tmpcbcfg"`
 
 	for c in CONFIG_HAVE_MRC CONFIG_HAVE_ME_BIN CONFIG_KBC1126_FIRMWARE \
-	    CONFIG_VGA_BIOS_FILE CONFIG_INCLUDE_SMSC_SCH5545_EC_FW; do
+	    CONFIG_VGA_BIOS_FILE CONFIG_INCLUDE_SMSC_SCH5545_EC_FW \
+	    CONFIG_LENOVO_TBFW_BIN; do
 		eval "[ \"\${$c}\" = \"/dev/null\" ] && continue"
 		eval "[ -z \"\${$c}\" ] && continue"
 		eval `setcfg "config/vendor/$vcfg/pkg.cfg"`; return 0
@@ -82,7 +85,9 @@ getfiles()
 	[ -z "$CONFIG_VGA_BIOS_FILE" ] || fetch e6400vga "$E6400_VGA_DL_url" \
 	  "$E6400_VGA_DL_url_bkup" "$E6400_VGA_DL_hash" "$CONFIG_VGA_BIOS_FILE"
 	[ -z "$CONFIG_HAVE_MRC" ] || fetch "mrc" "$MRC_url" "$MRC_url_bkup" \
-	    "$MRC_hash" "$CONFIG_MRC_FILE"; return 0
+	    "$MRC_hash" "$CONFIG_MRC_FILE"
+	[ -z "$CONFIG_LENOVO_TBFW_BIN" ] || fetch "tbfw" "$TBFW_url" \
+	    "$TBFW_url_bkup" "$TBFW_hash" "$CONFIG_LENOVO_TBFW_BIN"; return 0
 }
 
 fetch()
@@ -231,6 +236,25 @@ extract_sch5545ec()
 	cp "$_sch5545ec_fw" "$_dest" || $err "$_dest: !sch5545 copy"
 }
 
+# Lenovo ThunderBolt firmware updates:
+# https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t480-type-20l5-20l6/20l5/solutions/ht508988
+extract_tbfw()
+{
+	x_ mkdir -p tmp
+	find "$appdir" -type f -name "TBT.bin" > "tmp/tb.txt" || \
+	    $err "extract_tbfw $_dest: Can't extract TBT.bin"
+	while read -r f; do
+		[ -f "$f" ] || continue
+		[ -L "$f" ] && continue
+		cp "$f" "tmp/tb.bin" || \
+		    $err "extract_tbfw $_dest: Can't copy TBT.bin"
+		break
+	done < "tmp/tb.txt"
+	dd if=/dev/null of=tmp/tb.bin bs=1 seek=1048576 || \
+	    $err "extract_tbfw $_dest: Can't pad TBT.bin"
+	cp "tmp/tb.bin" "$_dest" || $err "extract_tbfw $_dest: copy error"; :
+}
+
 vendor_inject()
 {
 	set +u +e; [ $# -lt 1 ] && $err "No options specified."