build/boot/roms: Support removing microcode

From now on, the following rules are available for all
mainboards, in resources/coreboot/boardname/board.cfg:

* blobs_required="n" or "y"
* microcode_required="n" or "y"

The blobs setting, if set to "n", simply renames filename.rom to
filename_noblobs.rom.

The microcode setting, if set to "n", copies the ROM (with or
without _noblobs) to filename_nomicrocode.rom (if blobs="n",
it would be filename_noblobs_nomicrocode.rom).

Where "nomicrocode" is set, ROMs with microcode will still be
provided by lbmk and in relesase, but ROMs will also be provided
alongside it that lacks any microcode updates.

If the *original* ROM already lacks microcode updates, then the
original ROM will be *renamed* to include "nomicrocode" in the name.
This is done on images for ARM platforms, for instance, where
microcode is never used whatsoever.

Example filenames now generated:
seabios_e6400_4mb_libgfxinit_corebootfb_noblobs_nomicrocode.rom
seabios_e6400_4mb_libgfxinit_corebootfb_noblobs.rom
seabios_withgrub_hp8300usdt_16mb_libgfxinit_corebootfb_colemak_nomicrocode.rom
seabios_withgrub_hp8300usdt_16mb_libgfxinit_corebootfb_colemak.rom
uboot_payload_gru_kevin_libgfxinit_corebootfb_noblobs_nomicrocode.rom

A vocal minority of people were not happy with some of the changes
made in Libreboot last year, including on existing supported
hardware from before those changes were made. I did this before the
last release, out of respect:
https://libreboot.org/news/gm45microcode.html
(re-add mitigations for no-microcode setup on GM45)

This new change is done as an further, extended courtesy. Tested
and works fine. (testing using cbfstool-print)

Actual Libreboot policy about binary blobs is nuanced. See:
https://libreboot.org/news/policy.html (reduction policy) and:
https://libreboot.org/freedom-status.html (implementation)

Well, the status page talks about descriptor vs non-descriptor
on Intel platforms, and where me_cleaner is used (on platforms
that need Intel ME firmware), it regards the descriptored setups
to be blob-free if coreboot does not require binary blobs.

In this paradigm, microcode updates are not considered to be
binary blobs, because they aren't technically software, they're
more like config files that just turn certain features on or off
within the CPU.

However, for lbmk purposes, "noblobs" means that, after the ROM
is fully ready to flash on the chip, there will be no blobs in
it (except microcode). So for example, an X200 that does not
require ME firmware is considered blob-free under this paradigm,
even though Libreboot policy regards X230 as equally libre when
me_cleaner is used; in this setup, ROMs will not contain "blobfree"
in the filename, for X230 (as one example).

Signed-off-by: Leah Rowe <leah@libreboot.org>

61 files changed, 129 insertions, 1 deletions

diff --git a/resources/coreboot/d510mo/board.cfg b/resources/coreboot/d510mo/board.cfg
index e1fdade..c8fbe3f 100644
--- a/resources/coreboot/d510mo/board.cfg
+++ b/resources/coreboot/d510mo/board.cfg
@@ -4,3 +4,5 @@ arch="x86_64"
 payload_grub="n"
 payload_grub_withseabios="n"
 payload_seabios="y"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/d510mo_16mb/board.cfg b/resources/coreboot/d510mo_16mb/board.cfg
index 6d02fbf..6dc78fb 100644
--- a/resources/coreboot/d510mo_16mb/board.cfg
+++ b/resources/coreboot/d510mo_16mb/board.cfg
@@ -5,3 +5,5 @@ payload_grub="y"
 payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/e6400_4mb/board.cfg b/resources/coreboot/e6400_4mb/board.cfg
index 98a9e63..4471435 100644
--- a/resources/coreboot/e6400_4mb/board.cfg
+++ b/resources/coreboot/e6400_4mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="n"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/g43t-am3/board.cfg b/resources/coreboot/g43t-am3/board.cfg
index e1fdade..c8fbe3f 100644
--- a/resources/coreboot/g43t-am3/board.cfg
+++ b/resources/coreboot/g43t-am3/board.cfg
@@ -4,3 +4,5 @@ arch="x86_64"
 payload_grub="n"
 payload_grub_withseabios="n"
 payload_seabios="y"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/g43t-am3_16mb/board.cfg b/resources/coreboot/g43t-am3_16mb/board.cfg
index 9325446..4e65e66 100644
--- a/resources/coreboot/g43t-am3_16mb/board.cfg
+++ b/resources/coreboot/g43t-am3_16mb/board.cfg
@@ -5,3 +5,5 @@ payload_grub="n"
 payload_grub_withseabios="n"
 payload_seabios="y"
 payload_memtest="n"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/gru_bob/board.cfg b/resources/coreboot/gru_bob/board.cfg
index e69bd57..22e6c33 100644
--- a/resources/coreboot/gru_bob/board.cfg
+++ b/resources/coreboot/gru_bob/board.cfg
@@ -2,3 +2,5 @@ cbtree="cros"
 romtype="normal"
 arch="AArch64"
 payload_uboot="y"
+blobs_required="n"
+microcode_required="n"
diff --git a/resources/coreboot/gru_kevin/board.cfg b/resources/coreboot/gru_kevin/board.cfg
index e69bd57..22e6c33 100644
--- a/resources/coreboot/gru_kevin/board.cfg
+++ b/resources/coreboot/gru_kevin/board.cfg
@@ -2,3 +2,5 @@ cbtree="cros"
 romtype="normal"
 arch="AArch64"
 payload_uboot="y"
+blobs_required="n"
+microcode_required="n"
diff --git a/resources/coreboot/hp2560p_8mb/board.cfg b/resources/coreboot/hp2560p_8mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/hp2560p_8mb/board.cfg
+++ b/resources/coreboot/hp2560p_8mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/hp2570p_16mb/board.cfg b/resources/coreboot/hp2570p_16mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/hp2570p_16mb/board.cfg
+++ b/resources/coreboot/hp2570p_16mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/hp8200sff_4mb/board.cfg b/resources/coreboot/hp8200sff_4mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/hp8200sff_4mb/board.cfg
+++ b/resources/coreboot/hp8200sff_4mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/hp8200sff_8mb/board.cfg b/resources/coreboot/hp8200sff_8mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/hp8200sff_8mb/board.cfg
+++ b/resources/coreboot/hp8200sff_8mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/hp8300usdt_16mb/board.cfg b/resources/coreboot/hp8300usdt_16mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/hp8300usdt_16mb/board.cfg
+++ b/resources/coreboot/hp8300usdt_16mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/hp9470m_16mb/board.cfg b/resources/coreboot/hp9470m_16mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/hp9470m_16mb/board.cfg
+++ b/resources/coreboot/hp9470m_16mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/macbook11/board.cfg b/resources/coreboot/macbook11/board.cfg
index 66c5e56..067e97d 100644
--- a/resources/coreboot/macbook11/board.cfg
+++ b/resources/coreboot/macbook11/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/macbook11_16mb/board.cfg b/resources/coreboot/macbook11_16mb/board.cfg
index 66c5e56..067e97d 100644
--- a/resources/coreboot/macbook11_16mb/board.cfg
+++ b/resources/coreboot/macbook11_16mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/macbook21/board.cfg b/resources/coreboot/macbook21/board.cfg
index 61f94f9..3a5069b 100644
--- a/resources/coreboot/macbook21/board.cfg
+++ b/resources/coreboot/macbook21/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/macbook21_16mb/board.cfg b/resources/coreboot/macbook21_16mb/board.cfg
index 61f94f9..3a5069b 100644
--- a/resources/coreboot/macbook21_16mb/board.cfg
+++ b/resources/coreboot/macbook21_16mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/nyan_big/board.cfg b/resources/coreboot/nyan_big/board.cfg
index cf80db7..7270d02 100644
--- a/resources/coreboot/nyan_big/board.cfg
+++ b/resources/coreboot/nyan_big/board.cfg
@@ -2,3 +2,5 @@ cbtree="cros"
 romtype="normal"
 arch="ARMv7"
 payload_uboot="y"
+blobs_required="n"
+microcode_required="n"
diff --git a/resources/coreboot/nyan_blaze/board.cfg b/resources/coreboot/nyan_blaze/board.cfg
index cf80db7..7270d02 100644
--- a/resources/coreboot/nyan_blaze/board.cfg
+++ b/resources/coreboot/nyan_blaze/board.cfg
@@ -2,3 +2,5 @@ cbtree="cros"
 romtype="normal"
 arch="ARMv7"
 payload_uboot="y"
+blobs_required="n"
+microcode_required="n"
diff --git a/resources/coreboot/qemu_arm64_12mb/board.cfg b/resources/coreboot/qemu_arm64_12mb/board.cfg
index 6b9a58a..cbd485f 100644
--- a/resources/coreboot/qemu_arm64_12mb/board.cfg
+++ b/resources/coreboot/qemu_arm64_12mb/board.cfg
@@ -2,3 +2,5 @@ cbtree="default"
 romtype="normal"
 arch="AArch64"
 payload_uboot="y"
+blobs_required="n"
+microcode_required="n"
diff --git a/resources/coreboot/qemu_x86_12mb/board.cfg b/resources/coreboot/qemu_x86_12mb/board.cfg
index 1c267aa..4201de1 100644
--- a/resources/coreboot/qemu_x86_12mb/board.cfg
+++ b/resources/coreboot/qemu_x86_12mb/board.cfg
@@ -7,3 +7,5 @@ payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
 payload_uboot="y"
+blobs_required="n"
+microcode_required="n"
diff --git a/resources/coreboot/r400_16mb/board.cfg b/resources/coreboot/r400_16mb/board.cfg
index c8aed01..9958c2b 100644
--- a/resources/coreboot/r400_16mb/board.cfg
+++ b/resources/coreboot/r400_16mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/r400_4mb/board.cfg b/resources/coreboot/r400_4mb/board.cfg
index 7332682..537817d 100644
--- a/resources/coreboot/r400_4mb/board.cfg
+++ b/resources/coreboot/r400_4mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/r400_8mb/board.cfg b/resources/coreboot/r400_8mb/board.cfg
index ee8ee02..db4651e 100644
--- a/resources/coreboot/r400_8mb/board.cfg
+++ b/resources/coreboot/r400_8mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/r500_4mb/board.cfg b/resources/coreboot/r500_4mb/board.cfg
index df4bf79..28450ce 100644
--- a/resources/coreboot/r500_4mb/board.cfg
+++ b/resources/coreboot/r500_4mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/t400_16mb/board.cfg b/resources/coreboot/t400_16mb/board.cfg
index c8aed01..9958c2b 100644
--- a/resources/coreboot/t400_16mb/board.cfg
+++ b/resources/coreboot/t400_16mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/t400_4mb/board.cfg b/resources/coreboot/t400_4mb/board.cfg
index 7332682..537817d 100644
--- a/resources/coreboot/t400_4mb/board.cfg
+++ b/resources/coreboot/t400_4mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/t400_8mb/board.cfg b/resources/coreboot/t400_8mb/board.cfg
index ee8ee02..db4651e 100644
--- a/resources/coreboot/t400_8mb/board.cfg
+++ b/resources/coreboot/t400_8mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/t420_8mb/board.cfg b/resources/coreboot/t420_8mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/t420_8mb/board.cfg
+++ b/resources/coreboot/t420_8mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/t420s_8mb/board.cfg b/resources/coreboot/t420s_8mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/t420s_8mb/board.cfg
+++ b/resources/coreboot/t420s_8mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/t430_12mb/board.cfg b/resources/coreboot/t430_12mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/t430_12mb/board.cfg
+++ b/resources/coreboot/t430_12mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/t440p_12mb/board.cfg b/resources/coreboot/t440p_12mb/board.cfg
index 8a6367d..23ea22b 100644
--- a/resources/coreboot/t440p_12mb/board.cfg
+++ b/resources/coreboot/t440p_12mb/board.cfg
@@ -5,3 +5,4 @@ payload_grub="n"
 payload_grub_withseabios="n"
 payload_seabios="y"
 payload_memtest="y"
+microcode_required="n"
diff --git a/resources/coreboot/t440pmrc_12mb/board.cfg b/resources/coreboot/t440pmrc_12mb/board.cfg
index b40d70a..911501b 100644
--- a/resources/coreboot/t440pmrc_12mb/board.cfg
+++ b/resources/coreboot/t440pmrc_12mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/t500_16mb/board.cfg b/resources/coreboot/t500_16mb/board.cfg
index c8aed01..9958c2b 100644
--- a/resources/coreboot/t500_16mb/board.cfg
+++ b/resources/coreboot/t500_16mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/t500_4mb/board.cfg b/resources/coreboot/t500_4mb/board.cfg
index 7332682..537817d 100644
--- a/resources/coreboot/t500_4mb/board.cfg
+++ b/resources/coreboot/t500_4mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/t500_8mb/board.cfg b/resources/coreboot/t500_8mb/board.cfg
index ee8ee02..db4651e 100644
--- a/resources/coreboot/t500_8mb/board.cfg
+++ b/resources/coreboot/t500_8mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/t520_8mb/board.cfg b/resources/coreboot/t520_8mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/t520_8mb/board.cfg
+++ b/resources/coreboot/t520_8mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/t530_12mb/board.cfg b/resources/coreboot/t530_12mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/t530_12mb/board.cfg
+++ b/resources/coreboot/t530_12mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/t60_16mb_intelgpu/board.cfg b/resources/coreboot/t60_16mb_intelgpu/board.cfg
index 66c5e56..067e97d 100644
--- a/resources/coreboot/t60_16mb_intelgpu/board.cfg
+++ b/resources/coreboot/t60_16mb_intelgpu/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/t60_intelgpu/board.cfg b/resources/coreboot/t60_intelgpu/board.cfg
index 66c5e56..067e97d 100644
--- a/resources/coreboot/t60_intelgpu/board.cfg
+++ b/resources/coreboot/t60_intelgpu/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/w500_16mb/board.cfg b/resources/coreboot/w500_16mb/board.cfg
index c8aed01..9958c2b 100644
--- a/resources/coreboot/w500_16mb/board.cfg
+++ b/resources/coreboot/w500_16mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/w500_4mb/board.cfg b/resources/coreboot/w500_4mb/board.cfg
index 7332682..537817d 100644
--- a/resources/coreboot/w500_4mb/board.cfg
+++ b/resources/coreboot/w500_4mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/w500_8mb/board.cfg b/resources/coreboot/w500_8mb/board.cfg
index ee8ee02..db4651e 100644
--- a/resources/coreboot/w500_8mb/board.cfg
+++ b/resources/coreboot/w500_8mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/w530_12mb/board.cfg b/resources/coreboot/w530_12mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/w530_12mb/board.cfg
+++ b/resources/coreboot/w530_12mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/w541_12mb/board.cfg b/resources/coreboot/w541_12mb/board.cfg
index 8a6367d..23ea22b 100644
--- a/resources/coreboot/w541_12mb/board.cfg
+++ b/resources/coreboot/w541_12mb/board.cfg
@@ -5,3 +5,4 @@ payload_grub="n"
 payload_grub_withseabios="n"
 payload_seabios="y"
 payload_memtest="y"
+microcode_required="n"
diff --git a/resources/coreboot/w541mrc_12mb/board.cfg b/resources/coreboot/w541mrc_12mb/board.cfg
index b40d70a..911501b 100644
--- a/resources/coreboot/w541mrc_12mb/board.cfg
+++ b/resources/coreboot/w541mrc_12mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/x200_16mb/board.cfg b/resources/coreboot/x200_16mb/board.cfg
index c8aed01..9958c2b 100644
--- a/resources/coreboot/x200_16mb/board.cfg
+++ b/resources/coreboot/x200_16mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/x200_4mb/board.cfg b/resources/coreboot/x200_4mb/board.cfg
index 7332682..537817d 100644
--- a/resources/coreboot/x200_4mb/board.cfg
+++ b/resources/coreboot/x200_4mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/x200_8mb/board.cfg b/resources/coreboot/x200_8mb/board.cfg
index ee8ee02..db4651e 100644
--- a/resources/coreboot/x200_8mb/board.cfg
+++ b/resources/coreboot/x200_8mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/x220_8mb/board.cfg b/resources/coreboot/x220_8mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/x220_8mb/board.cfg
+++ b/resources/coreboot/x220_8mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/x230_12mb/board.cfg b/resources/coreboot/x230_12mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/x230_12mb/board.cfg
+++ b/resources/coreboot/x230_12mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/x230_16mb/board.cfg b/resources/coreboot/x230_16mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/x230_16mb/board.cfg
+++ b/resources/coreboot/x230_16mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/x230edp_12mb/board.cfg b/resources/coreboot/x230edp_12mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/x230edp_12mb/board.cfg
+++ b/resources/coreboot/x230edp_12mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/x230t_12mb/board.cfg b/resources/coreboot/x230t_12mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/x230t_12mb/board.cfg
+++ b/resources/coreboot/x230t_12mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/x230t_16mb/board.cfg b/resources/coreboot/x230t_16mb/board.cfg
index e7626cf..8c2cf6d 100644
--- a/resources/coreboot/x230t_16mb/board.cfg
+++ b/resources/coreboot/x230t_16mb/board.cfg
@@ -6,3 +6,4 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
diff --git a/resources/coreboot/x301_16mb/board.cfg b/resources/coreboot/x301_16mb/board.cfg
index c8aed01..9958c2b 100644
--- a/resources/coreboot/x301_16mb/board.cfg
+++ b/resources/coreboot/x301_16mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/x301_4mb/board.cfg b/resources/coreboot/x301_4mb/board.cfg
index 7332682..537817d 100644
--- a/resources/coreboot/x301_4mb/board.cfg
+++ b/resources/coreboot/x301_4mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/x301_8mb/board.cfg b/resources/coreboot/x301_8mb/board.cfg
index ee8ee02..db4651e 100644
--- a/resources/coreboot/x301_8mb/board.cfg
+++ b/resources/coreboot/x301_8mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/x60/board.cfg b/resources/coreboot/x60/board.cfg
index 66c5e56..067e97d 100644
--- a/resources/coreboot/x60/board.cfg
+++ b/resources/coreboot/x60/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/coreboot/x60_16mb/board.cfg b/resources/coreboot/x60_16mb/board.cfg
index 66c5e56..067e97d 100644
--- a/resources/coreboot/x60_16mb/board.cfg
+++ b/resources/coreboot/x60_16mb/board.cfg
@@ -6,3 +6,5 @@ payload_grub_withseabios="y"
 payload_seabios="y"
 payload_memtest="y"
 grub_scan_disk="ahci"
+microcode_required="n"
+blobs_required="n"
diff --git a/resources/scripts/build/boot/roms_helper b/resources/scripts/build/boot/roms_helper
index 02d8f61..d87942d 100755
--- a/resources/scripts/build/boot/roms_helper
+++ b/resources/scripts/build/boot/roms_helper
@@ -60,6 +60,10 @@ cbfstool=""
 corebootrom=""
 seavgabiosrom=""
 
+# almost all boards will set at least one of these to "n"
+blobs_required=""
+microcode_required=""
+
 CROSS_COMPILE=""
 
 main()
@@ -172,6 +176,14 @@ load_config()
 			[ "${uboot_config}" = "undefined" ]; then
 		uboot_config="default"
 	fi
+	if [ "${microcode_required}" != "n" ] \
+			&& [ "${microcode_required}" != "y" ]; then
+		microcode_required="y"
+	fi
+	if [ "${blobs_required}" != "n" ] \
+			&& [ "${blobs_required}" != "y" ]; then
+		blobs_required="y"
+	fi
 
 	load_config_overrides
 	die_if_cbconfig_and_nopayload
@@ -689,6 +701,10 @@ moverom()
 	_newrom="$2"
 	cuttype="$3"
 
+	if [ "${blobs_required}" = "n" ]; then
+		_newrom="${_newrom%.rom}_noblobs.rom"
+	fi
+
 	printf "\nCreating new ROM image: %s\n" "${_newrom}"
 
 	cp ${rompath} ${_newrom}
@@ -701,7 +717,6 @@ moverom()
 				seek=$(($(stat -c %s ${_newrom}) - 0x20000)) \
 				count=64k conv=notrunc
 		rm -f top64k.bin
-		return 0
 	fi
 
 	for romsize in 4 8 16; do
@@ -723,6 +738,21 @@ moverom()
 					conv=notrunc
 		done
 	done
+
+	if [ "${microcode_required}" = "n" ]; then
+		_newrom_b="${_newrom%.rom}_nomicrocode.rom"
+		cp "${_newrom}" "${_newrom_b}" || exit 1
+		microcode_present="y"
+		"${cbfstool}" "${_newrom_b}" remove -n \
+				cpu_microcode_blob.bin || microcode_present="n"
+		if [ "${microcode_present}" = "n" ]; then
+			rm -f "${_newrom_b}" || exit 1
+			printf "REMARK: '%s' already lacks microcode\n" \
+					${_newrom}
+			printf "Renaming default ROM file instead.\n"
+			mv "${_newrom}" "${_newrom_b}" || exit 1
+		fi
+	fi
 }
 
 main $@