diff options
Diffstat (limited to 'include/fw')
| -rw-r--r-- | include/fw/inject.sh | 185 | ||||
| -rw-r--r-- | include/fw/mrc.sh | 69 | ||||
| -rw-r--r-- | include/fw/rom.sh | 393 | ||||
| -rw-r--r-- | include/fw/vendor.sh | 580 |
4 files changed, 1227 insertions, 0 deletions
diff --git a/include/fw/inject.sh b/include/fw/inject.sh new file mode 100644 index 00000000..2d4c99e6 --- /dev/null +++ b/include/fw/inject.sh @@ -0,0 +1,185 @@ +# SPDX-License-Identifier: GPL-3.0-only + +# Copyright (c) 2022 Caleb La Grange <thonkpeasant@protonmail.com> +# Copyright (c) 2022 Ferass El Hafidi <vitali64pmemail@protonmail.com> +# Copyright (c) 2023-2026 Leah Rowe <leah@libreboot.org> + +cbcfgsdir="config/module/coreboot" +tmpromdel="$XBMK_CACHE/DO_NOT_FLASH" +nvmutil="util/nvmutil/nvmutil" +ifdtool="elf/coreboot/default/ifdtool" + +checkvars="CONFIG_GBE_BIN_PATH ${checkvarsxbmk-} ${checkvarschk-}" + +eval "`newvar archive board boarddir IFD_platform ifdprefix \ + new_mac nuke tmpromdir tree xchanged $checkvars`" + +inject() +{ + remkdir "$tmpromdel" + + [ $# -lt 1 ] && err "No options specified" "inject" "$@" + + archive="$1"; + new_mac="xx:xx:xx:xx:xx:xx" + + [ $# -gt 1 ] && case "$2" in + nuke) + new_mac="" + nuke="nuke" + ;; + setmac) + if [ $# -gt 2 ]; then + new_mac="$3" && \ + [ -z "$new_mac" ] && \ + err "Empty MAC address" "inject" "$@"; : + fi + ;; + *) + err "Unrecognised inject mode: '$2'" "inject" "$@" ;; + esac + + [ "$new_mac" = "keep" ] && \ + new_mac="" + + check_release + if check_target; then + patch_release || return 0 + fi + [ "$xchanged" = "y" ] && \ + remktar + + x_ rm -Rf "$tmpromdel" +} + +check_release() +{ + [ -L "$archive" ] && \ + err "'$archive' is a symlink" "check_release" "$@" + e "$archive" f missing && \ + err "'$archive' missing" "check_release" "$@" + + archivename="`basename "$archive" || err "Can't get '$archive' name"`" \ + || err "can't get '$archive' name" "check_release" "$@" + + [ -z "$archivename" ] && \ + err "Can't determine archive name" "check_release" "$@" + + case "$archivename" in + *_src.tar.xz) + err "'$archive' is a src archive!" "check_release" "$@" + ;; + grub_*|seagrub_*|custom_*|seauboot_*|seabios_withgrub_*) + err "'$archive' is a ROM image" "check_release" "$@" + ;; + *.tar.xz) _stripped_prefix="${archivename#*_}" + board="${_stripped_prefix%.tar.xz}" + ;; + *) + err "'$archive': cannot detect board" "check_release" "$@" + ;; + esac; : +} + +check_target() +{ + [ "$board" = "${board#serprog_}" ] || return 1 + + boarddir="$cbcfgsdir/$board" + + . "$boarddir/target.cfg" || \ + err "Can't read '$boarddir/target.cfg'" "check_target" "$@" + + [ -z "$tree" ] && \ + err "tree unset in '$boarddir/target.cfg'" "check_target" "$@" + + x_ "$mk" -d coreboot "$tree" + + ifdtool="elf/coreboot/$tree/ifdtool" + [ -n "$IFD_platform" ] && \ + ifdprefix="-p $IFD_platform"; : +} + +patch_release() +{ + [ "$nuke" != "nuke" ] && \ + x_ "$mk" download "$board" + + has_hashes="n" + tmpromdir="$tmpromdel/bin/$board" + + remkdir "${tmpromdir%"/bin/$board"}" + x_ tar -xf "$archive" -C "${tmpromdir%"/bin/$board"}" + + for _hashes in "vendorhashes" "blobhashes"; do + if e "$tmpromdir/$_hashes" f; then + has_hashes="y" + hashfile="$_hashes" + + break + fi + done + + readkconfig || return 1 + + [ -n "$new_mac" ] && [ -n "$CONFIG_GBE_BIN_PATH" ] && \ + modify_mac; : +} + +readkconfig() +{ + x_ rm -f "$xbtmp/cbcfg" + fx_ scankconfig x_ find "$boarddir/config" -type f + + e "$xbtmp/cbcfg" f missing && \ + return 1 + + . "$xbtmp/cbcfg" || \ + err "Can't read '$xbtmp/cbcfg'" "readkconfig" "$@" + + setvfile "$@" || return 1; : +} + +scankconfig() +{ + for cbc in $checkvars; do + grep "$cbc" "$1" 2>/dev/null 1>>"$xbtmp/cbcfg" || : + done +} + +modify_mac() +{ + x_ cp "${CONFIG_GBE_BIN_PATH##*../}" "$xbtmp/gbe" + + if [ -n "$new_mac" ] && [ "$new_mac" != "restore" ]; then + forx 'x_ make -C util/nvmutil %s' clean nvmutil + x_ "$nvmutil" "$xbtmp/gbe" setmac "$new_mac" + fi + + fx_ newmac x_ find "$tmpromdir" -mindepth 1 -maxdepth 1 \ + -type f -name "*.rom" + + printf "\nThe following GbE NVM data will be written:\n" + x_ "$nvmutil" "$xbtmp/gbe" dump | grep -v "bytes read from file" || : +} + +newmac() +{ + e "$1" f || return 0 + xchanged="y" + x_ "$ifdtool" $ifdprefix -i GbE:"$xbtmp/gbe" "$1" -O "$1" +} + +remktar() +{ + ( + x_ cd "${tmpromdir%"/bin/$board"}" + + printf "Re-building tar archive (please wait)\n" + mkrom_tarball "bin/$board" 1>/dev/null + + ) || err "Cannot re-generate '$archive'" "remktar" "$@" + + mv "${tmpromdir%"/bin/$board"}/bin/${relname}_${board}.tar.xz" \ + "$archive" || err "'$archive' -> Can't overwrite" "remktar" "$@"; : +} diff --git a/include/fw/mrc.sh b/include/fw/mrc.sh new file mode 100644 index 00000000..19003af7 --- /dev/null +++ b/include/fw/mrc.sh @@ -0,0 +1,69 @@ +# SPDX-License-Identifier: GPL-2.0-only + +# Logic based on util/chromeos/crosfirmware.sh in coreboot cfc26ce278. +# Modifications in this version are Copyright 2021,2023-2025 Leah Rowe. +# Original copyright detailed in repo: https://review.coreboot.org/coreboot/ + +eval "`newvar MRC_board MRC_hash MRC_url MRC_url_bkup SHELLBALL`" + +extract_refcode() +{ + extract_mrc + + # cbfstool after coreboot 4.13 changed the stage file attribute scheme, + # and refcode is extracted from an image using the old scheme. we use + # cbfstool from coreboot 4.11_branch, the tree used by ASUS KGPE-D16: + + [ -z "$cbfstoolref" ] && \ + err "cbfstoolref not set" "extract_refcode" "$@" + + x_ mkdir -p "${_pre_dest%/*}" + + x_ "$cbfstoolref" "$appdir/bios.bin" extract \ + -m x86 -n fallback/refcode -f "$appdir/ref" -r RO_SECTION + + # enable the Intel GbE device, if told by offset MRC_refcode_gbe + [ -n "$MRC_refcode_gbe" ] && \ + x_ dd if="config/snippet/1" of="$appdir/ref" bs=1 \ + seek=$MRC_refcode_gbe count=1 conv=notrunc; : + + x_ mv "$appdir/ref" "$_pre_dest" +} + +extract_mrc() +{ + [ -z "$MRC_board" ] && \ + err "MRC_board unset" "extract_mrc" "$@" + [ -z "$CONFIG_MRC_FILE" ] && \ + err "CONFIG_MRC_FILE unset" "extract_mrc" "$@" + + SHELLBALL="chromeos-firmwareupdate-$MRC_board" + + ( + x_ cd "$appdir" + extract_partition "${MRC_url##*/}" + extract_archive "$SHELLBALL" . + + ) || err "mrc download/extract failure" "extract_mrc" "$@" + + x_ "$cbfstool" "$appdir/"bios.bin extract -n mrc.bin \ + -f "${_pre_dest%/*}/mrc.bin" -r RO_SECTION +} + +extract_partition() +{ + printf "Extracting ROOT-A partition\n" + + ROOTP=$( printf "unit\nB\nprint\nquit\n" | \ + parted "${1%.zip}" 2>/dev/null | grep "ROOT-A" ) + + START=$(( $( echo $ROOTP | cut -f2 -d\ | tr -d "B" ) )) + SIZE=$(( $( echo $ROOTP | cut -f4 -d\ | tr -d "B" ) )) + + x_ dd if="${1%.zip}" of="root-a.ext2" bs=1024 \ + skip=$(( $START / 1024 )) count=$(( $SIZE / 1024 )) + + printf "cd /usr/sbin\ndump chromeos-firmwareupdate %s\nquit" \ + "$SHELLBALL" | debugfs "root-a.ext2" || \ + err "!extract shellball" "extract_partition" "$@" +} diff --git a/include/fw/rom.sh b/include/fw/rom.sh new file mode 100644 index 00000000..df37fdcf --- /dev/null +++ b/include/fw/rom.sh @@ -0,0 +1,393 @@ +# SPDX-License-Identifier: GPL-3.0-or-later + +# Copyright (c) 2014-2016,2020-2021,2023-2025 Leah Rowe <leah@libreboot.org> +# Copyright (c) 2021-2022 Ferass El Hafidi <vitali64pmemail@protonmail.com> +# Copyright (c) 2022 Caleb La Grange <thonkpeasant@protonmail.com> +# Copyright (c) 2022-2023 Alper Nebi Yasak <alpernebiyasak@gmail.com> +# Copyright (c) 2023-2024 Riku Viitanen <riku.viitanen@protonmail.com> + +grubdata="config/data/grub" + +buildser() +{ + if [ "$1" = "pico" ]; then + x_ cmake -DPICO_BOARD="$2" \ + -DPICO_SDK_PATH="$picosdk" -B "$sersrc/build" "$sersrc" + x_ cmake --build "$sersrc/build" + elif [ "$1" = "stm32" ]; then + x_ make -C "$sersrc" libopencm3-just-make BOARD=$2 + x_ make -C "$sersrc" BOARD=$2 + fi + + x_ mkdir -p "bin/serprog_$1" + x_ mv "$serx" "bin/serprog_$1/serprog_$2.${serx##*.}" +} + +copyps1bios() +{ + remkdir "bin/playstation" + x_ cp src/pcsx-redux/default/src/mips/openbios/openbios.bin \ + bin/playstation + + printf "MIT License\n\nCopyright (c) 2019-2025 PCSX-Redux authors\n\n" \ + > bin/playstation/COPYING.txt || \ + err "can't write PCSX Redux copyright info" "copyps1bios" "$@" + + x_ cat config/snippet/mit >>bin/playstation/COPYING.txt || \ + err "can't copy MIT license snippet" "copyps1bios" "$@" +} + +mkpayload_grub() +{ + eval "`newvar grub_modules grub_install_modules`" + + . "$grubdata/module/$tree" || \ + err "Can't read '$grubdata/module/$tree'" "mkpayload_grub" "$@" + + x_ rm -f "$srcdir/grub.elf" + + x_ "$srcdir/grub-mkstandalone" \ + --grub-mkimage="$srcdir/grub-mkimage" \ + -O i386-coreboot -o "$srcdir/grub.elf" -d "${srcdir}/grub-core/" \ + --fonts= --themes= --locales= --modules="$grub_modules" \ + --install-modules="$grub_install_modules" \ + "/boot/grub/grub_default.cfg=$grubdata/cfg/$tree.config" \ + "/boot/grub/grub.cfg=$grubdata/memdisk.cfg"; : +} + +corebootpremake() +{ + [ "$XBMK_RELEASE" = "y" ] && [ "$release" = "n" ] && \ + return 0 + + forx 'check_coreboot_util %s' cbfstool ifdtool + + printf "%s\n" "${version%%-*}" > "$srcdir/.coreboot-version" || \ + err "!mk $srcdir .coreboot-version" "corebootpremake" "$@" + + [ "$target" != "$tree" ] && \ + x_ "$mk" download "$target"; : +} + +check_coreboot_util() +{ + e "elf/coreboot/$tree/$1" f && \ + return 0 + + utilelfdir="elf/coreboot/$tree" + utilsrcdir="src/coreboot/$tree/util/$1" + + utilmode="" + [ -n "$mode" ] && \ + utilmode="clean" + + x_ make -C "$utilsrcdir" $utilmode -j$XBMK_THREADS $makeargs + + if [ -n "$mode" ]; then + x_ rm -Rf "$utilelfdir" + return 0 + elif [ -n "$mode" ] || [ -f "$utilelfdir/$1" ]; then + return 0 + fi + + x_ mkdir -p "$utilelfdir" + x_ cp "$utilsrcdir/$1" "$utilelfdir" + + [ "$1" = "cbfstool" ] && \ + x_ cp "$utilsrcdir/rmodtool" "$utilelfdir"; : +} + +coreboot_pad_one_byte() +{ + [ "$XBMK_RELEASE" = "y" ] && [ "$release" = "n" ] && \ + return 0 + + $if_not_skip_build pad_one_byte "$srcdir/build/coreboot.rom" +} + +mkcorebootbin() +{ + [ "$XBMK_RELEASE" = "y" ] && [ "$release" = "n" ] && \ + return 0 + + for y in "$defscan"/*; do + buildcfg="$y" + $if_not_skip_build mkcorebootbin_real + done + + $if_not_skip_build mkcoreboottar +} + +mkcorebootbin_real() +{ + [ "$target" = "$tree" ] && return 0 + + tmprom="$xbtmp/coreboot.rom" + + initmode="${buildcfg##*/}" + displaymode="${initmode##*_}" + if [ "$displaymode" = "$initmode" ]; then + # blank it for "normal" or "fspgop" configs: + + displaymode="" + fi + initmode="${initmode%%_*}" + cbfstool="elf/coreboot/$tree/cbfstool" + + # cbfstool option backends, if they exist + cbfscfg="config/module/coreboot/$target/cbfs.cfg" + + elfrom="elf/coreboot/$tree/$target/$initmode" + [ -n "$displaymode" ] && \ + elfrom="${elfrom}_$displaymode" + elfrom="$elfrom/coreboot.rom" + + $if_not_skip_build x_ cp "$elfrom" "$tmprom" + $if_not_skip_build unpad_one_byte "$tmprom" + + [ -n "$payload_uboot" ] && [ "$payload_uboot" != "amd64" ] && \ + [ "$payload_uboot" != "i386" ] && [ "$payload_uboot" != "arm64" ] \ + && err "'$target' defines bad u-boot type '$payload_uboot'" \ + "mkcorebootbin_real" "$@" + + [ -n "$payload_uboot" ] && [ "$payload_uboot" != "arm64" ] && \ + payload_seabios="y" + + [ -z "$uboot_config" ] && \ + uboot_config="default" + [ "$payload_grub" = "y" ] && \ + payload_seabios="y" + [ "$payload_seabios" = "y" ] && [ "$payload_uboot" = "arm64" ] && \ + err "$target: U-Boot arm / SeaBIOS/GRUB both enabled" \ + "mkcorebootbin_real" "$@" + + [ -z "$grub_scan_disk" ] && \ + grub_scan_disk="nvme ahci ata" + [ -z "$grubtree" ] && \ + grubtree="default" + grubelf="elf/grub/$grubtree/$grubtree/noconfig/grub.elf" + + [ "$payload_memtest" != "y" ] && \ + payload_memtest="n" + [ "$(uname -m)" != "x86_64" ] && \ + payload_memtest="n" + + [ "$payload_grubsea" = "y" ] && [ "$initmode" = "normal" ] && \ + payload_grubsea="n" + [ "$payload_grub" != "y" ] && \ + payload_grubsea="n" + + [ -f "$cbfscfg" ] && \ + $if_not_skip_build dx_ add_cbfs_option "$cbfscfg" + + if grep "CONFIG_PAYLOAD_NONE=y" "$buildcfg"; then + if [ "$payload_seabios" = "y" ]; then + pname="seabios" + $if_not_skip_build add_seabios + fi + if [ "$payload_uboot" = "arm64" ]; then + pname="uboot" + $if_not_skip_build add_uboot "" fallback/payload \ + default "$target" u-boot.elf + fi + else + pname="custom" + $if_not_skip_build cprom + fi; : +} + +# options for cbfs backend (as opposed to nvram/smmstore): + +add_cbfs_option() +{ + op_name="`printf "%s\n" "$1" | awk '{print $1}'`" + op_arg="`printf "%s\n" "$1" | awk '{print $2}'`" + + if [ -z "$op_name" ] || [ -z "$op_arg" ]; then + return 0 + fi + + ( x_ "$cbfstool" "$tmprom" remove -n "option/$op_name" 1>/dev/null \ + 2>/dev/null ) || : + + x_ "$cbfstool" "$tmprom" add-int -i "$op_arg" -n "option/$op_name" +} + +# in our design, SeaBIOS is also responsible for starting either +# a GRUB or U-Boot payload. this is because SeaBIOS is generally +# a more reliable codebase, so it's less likely to cause a brick +# during testing and development, or user configuration. if one +# of the u-boot or grub payloads fails, the user still has a +# functional SeaBIOS setup to fall back on. watch: + +add_seabios() +{ + [ -n "$payload_uboot" ] && [ "$payload_uboot" != "arm64" ] && \ + [ "$displaymode" != "txtmode" ] && [ "$initmode" != "normal" ] && \ + add_uboot_x86 # u-boot first, due to fixed cbfs offset + + _seabioself="elf/seabios/default/build/$initmode/bios.bin.elf" + [ "$initmode" = "fspgop" ] && \ + _seabioself="elf/seabios/default/build/libgfxinit/bios.bin.elf" + + _seaname="fallback/payload" + [ "$payload_grubsea" = "y" ] && \ + _seaname="seabios.elf" + + cbfs "$tmprom" "$_seabioself" "$_seaname" + + x_ "$cbfstool" "$tmprom" add-int -i 3000 -n etc/ps2-keyboard-spinup + + opexec="2" + [ "$initmode" = "vgarom" ] && \ + opexec="0" + x_ "$cbfstool" "$tmprom" add-int -i $opexec -n etc/pci-optionrom-exec + + x_ "$cbfstool" "$tmprom" add-int -i 0 -n etc/optionroms-checksum + if [ "$initmode" = "libgfxinit" ] || [ "$initmode" = "fspgop" ]; then + cbfs "$tmprom" "$seavgabiosrom" vgaroms/seavgabios.bin raw + fi + + [ "$payload_memtest" = "y" ] && \ + cbfs "$tmprom" \ + "elf/memtest86plus/default/default/noconfig/memtest.bin" \ + img/memtest + + [ "$payload_grub" = "y" ] && \ + add_grub + + [ "$payload_grubsea" != "y" ] && \ + cprom # seabios, but don't load grub/u-boot first + + # now make seauboot(u-boot loaded by seabios) and SeaGRUB (GRUB loaded + # by SeaBIOS) images; users can bypass via ESC to boot from SeaBIOS + + if [ "$payload_uboot" = "amd64" ] && \ + [ "$displaymode" != "txtmode" ] && \ + [ "$initmode" != "normal" ] && [ "$payload_grubsea" != "y" ]; then + pname="seauboot" + cprom "seauboot" + fi + + if [ "$payload_grub" = "y" ]; then + pname="seagrub" + mkseagrub + fi +} + +add_grub() +{ + # path in CBFS for the GRUB payload + _grubname="img/grub2" + [ "$payload_grubsea" = "y" ] && \ + _grubname="fallback/payload" + + cbfs "$tmprom" "$grubelf" "$_grubname" + + printf "set grub_scan_disk=\"%s\"\n" "$grub_scan_disk" \ + > "$xbtmp/tmpcfg" || \ + err "$target: !insert scandisk" "add_grub" "$@" + + cbfs "$tmprom" "$xbtmp/tmpcfg" scan.cfg raw + + [ "$initmode" != "normal" ] && [ "$displaymode" != "txtmode" ] && \ + cbfs "$tmprom" "$grubdata/background/background1280x800.png" \ + "background.png" raw; : +} + +mkseagrub() +{ + if [ "$payload_grubsea" = "y" ]; then + pname="grub" + else + cbfs "$tmprom" "$grubdata/bootorder" bootorder raw + fi + + fx_ cprom x_ find "$grubdata/keymap" -type f -name "*.gkb" +} + +add_uboot_x86() +{ + [ "$payload_uboot" = "amd64" ] && \ + add_uboot "-l 0x1110000 -e 0x1110000" "img/u-boot" \ + "x86_64" "amd64coreboot" "u-boot-x86-with-spl.bin" + [ "$payload_uboot" = "i386" ] && \ + add_uboot "-l 0x1110000 -e 0x1110000" "u-boot" "x86" \ + "i386coreboot" "u-boot-dtb.bin"; : +} + +add_uboot() +{ + ubootelf="elf/u-boot/$3/$4/$uboot_config/$5" + [ ! -f "$ubootelf" ] && \ + ubootelf="${ubootelf%.elf}" # hack (fix arm64 build) + + cbfs "$tmprom" "$ubootelf" "$2" $1 + [ "$payload_seabios" != "y" ] && \ + cprom; : +} + +# prepare the final image in bin/ for user installation: +cprom() +{ + cpcmd="cp" + + tmpnew="" + newrom="bin/$target/${pname}_${target}_$initmode.rom" + + [ -n "$displaymode" ] && \ + newrom="${newrom%.rom}_$displaymode.rom" + if [ $# -gt 0 ] && [ "${1%.gkb}" != "$1" ]; then + tmpnew="${1##*/}" + newrom="${newrom%.rom}_${tmpnew%.gkb}.rom" + fi + + irom="$tmprom" + + if [ $# -gt 0 ]; then + irom="$(mktemp || err "!mk irom, $(echo "$@")")" || \ + err "can't copy rom" "cprom" "$@" + + x_ cp "$tmprom" "$irom" && cpcmd="mv" + + if [ "${1%.gkb}" != "$1" ]; then + cbfs "$irom" "$grubdata/keymap/$tmpnew" keymap.gkb raw + elif [ "$1" = "seauboot" ]; then + cbfs "$irom" "$grubdata/bootorder_uboot" bootorder raw + fi + fi + + printf "Creating new %s image: '%s'\n" "$projectname" "$newrom" + + x_ mkdir -p "bin/$target" + x_ $cpcmd "$irom" "$newrom" +} + +cbfs() +{ + ccmd="add-payload" + lzma="-c lzma" + + if [ $# -gt 3 ] && [ $# -lt 5 ]; then + ccmd="add" + lzma="-t $4" + elif [ $# -gt 4 ] && [ "$5" = "0x1110000" ]; then + ccmd="add-flat-binary" && \ + lzma="-c lzma -l 0x1110000 -e 0x1110000" + fi + + x_ "$cbfstool" "$1" $ccmd -f "$2" -n "$3" $lzma +} + +# for release files: + +mkcoreboottar() +{ + if [ "$target" = "$tree" ] || [ "$XBMK_RELEASE" != "y" ] || \ + [ "$release" = "n" ]; then + return 0 + fi + + mkrom_tarball "bin/$target" + x_ "$mk" inject "bin/${relname}_${target}.tar.xz" nuke +} diff --git a/include/fw/vendor.sh b/include/fw/vendor.sh new file mode 100644 index 00000000..bc69f458 --- /dev/null +++ b/include/fw/vendor.sh @@ -0,0 +1,580 @@ +# SPDX-License-Identifier: GPL-3.0-only + +# Copyright (c) 2022 Caleb La Grange <thonkpeasant@protonmail.com> +# Copyright (c) 2022 Ferass El Hafidi <vitali64pmemail@protonmail.com> +# Copyright (c) 2023-2026 Leah Rowe <leah@libreboot.org> + +# These are variables and functions, extending the functionality of +# inject.sh, to be used with lbmk; they are kept separate here, so that +# the main inject.sh can be as similar as possible between lbmk and cbmk, +# so that cherry-picking lbmk patches into cbmk yields fewer merge conflicts. + +# When reading this file, you should imagine that it is part of inject.sh, +# with inject.sh concatenated onto vendor.sh; they are inexorably intertwined. +# The main "mk" script sources vendor.sh first, and then inject.sh, in lbmk. + +e6400_unpack="$xbmkpwd/src/bios_extract/default/dell_inspiron_1100_unpacker.py" +me7updateparser="$xbmkpwd/util/me7_update_parser/me7_update_parser.py" +pfs_extract="$xbmkpwd/src/biosutilities/default/Dell_PFS_Extract.py" +uefiextract="$xbmkpwd/elf/uefitool/default/default/noconfig/uefiextract" +bsdtar="$xbmkpwd/elf/libarchive/default/default/noconfig/bsdtar" +bsdunzip="$xbmkpwd/elf/libarchive/default/default/noconfig/bsdunzip" +vendir="vendorfiles" +appdir="$vendir/app" +vfix="DO_NOT_FLASH_YET._FIRST,_INJECT_FILES_VIA_INSTRUCTIONS_ON_LIBREBOOT.ORG_" + +# lbmk-specific extension to the "checkvars" variable (not suitable for cbmk) +checkvarschk="CONFIG_INCLUDE_SMSC_SCH5545_EC_FW CONFIG_HAVE_MRC \ + CONFIG_HAVE_ME_BIN CONFIG_LENOVO_TBFW_BIN CONFIG_VGA_BIOS_FILE \ + CONFIG_FSP_M_FILE CONFIG_FSP_S_FILE CONFIG_KBC1126_FW1 CONFIG_KBC1126_FW2" + +# lbmk-specific extensions to the "checkvars" variable (not suitable for cbmk) +checkvarsxbmk="CONFIG_ME_BIN_PATH CONFIG_SMSC_SCH5545_EC_FW_FILE \ + CONFIG_FSP_FULL_FD CONFIG_KBC1126_FW1_OFFSET CONFIG_KBC1126_FW2_OFFSET \ + CONFIG_FSP_USE_REPO CONFIG_VGA_BIOS_ID CONFIG_BOARD_DELL_E6400 \ + CONFIG_FSP_S_CBFS CONFIG_HAVE_REFCODE_BLOB CONFIG_REFCODE_BLOB_FILE \ + CONFIG_FSP_FD_PATH CONFIG_IFD_BIN_PATH CONFIG_MRC_FILE CONFIG_FSP_M_CBFS" + +# lbmk-specific extensions; general variables +eval "`newvar cbdir cbfstoolref has_hashes hashfile kbc1126_ec_dump mecleaner \ + mfs nuke rom vcfg xromsize _7ztest _dest _dl _dl_bin _me _metmp _pre_dest`" + +# lbmk-specific extensions; declared by pkg.cfg files in config/vendor/ +eval "`newvar DL_hash DL_url DL_url_bkup E6400_VGA_bin_hash E6400_VGA_DL_hash \ + E6400_VGA_DL_url E6400_VGA_DL_url_bkup E6400_VGA_offset E6400_VGA_romname \ + EC_FW1_hash EC_FW2_hash EC_hash EC_url EC_url_bkup FSPFD_hash \ + FSPM_bin_hash FSPS_bin_hash ME11bootguard ME11delta ME11pch ME11sku \ + ME11version ME_bin_hash MEcheck MEclean MEshrink MRC_bin_hash \ + MRC_refcode_cbtree MRC_refcode_gbe REF_bin_hash SCH5545EC_bin_hash \ + SCH5545EC_DL_hash SCH5545EC_DL_url SCH5545EC_DL_url_bkup TBFW_bin_hash \ + TBFW_hash TBFW_size TBFW_url TBFW_url_bkup XBMKmecleaner`" + +download() +{ + [ $# -lt 1 ] && err "No argument given" "download" "$@" + + export PATH="$PATH:/sbin" + board="$1" + + check_target && readkconfig download; : +} + +getfiles() +{ + [ -n "$CONFIG_HAVE_ME_BIN" ] && \ + fetch intel_me "$DL_url" "$DL_url_bkup" "$DL_hash" \ + "$CONFIG_ME_BIN_PATH" curl "$ME_bin_hash" + [ -n "$CONFIG_INCLUDE_SMSC_SCH5545_EC_FW" ] && \ + fetch sch5545ec "$SCH5545EC_DL_url" "$SCH5545EC_DL_url_bkup" \ + "$SCH5545EC_DL_hash" "$CONFIG_SMSC_SCH5545_EC_FW_FILE" \ + "curl" "$SCH5545EC_bin_hash" + [ -n "$CONFIG_KBC1126_FW1" ] && \ + fetch kbc1126ec "$EC_url" "$EC_url_bkup" "$EC_hash" \ + "$CONFIG_KBC1126_FW1" curl "$EC_FW1_hash" + [ -n "$CONFIG_KBC1126_FW2" ] && \ + fetch kbc1126ec "$EC_url" "$EC_url_bkup" "$EC_hash" \ + "$CONFIG_KBC1126_FW2" curl "$EC_FW2_hash" + [ -n "$CONFIG_VGA_BIOS_FILE" ] && \ + fetch e6400vga "$E6400_VGA_DL_url" "$E6400_VGA_DL_url_bkup" \ + "$E6400_VGA_DL_hash" "$CONFIG_VGA_BIOS_FILE" "curl" \ + "$E6400_VGA_bin_hash" + [ -n "$CONFIG_HAVE_MRC" ] && \ + fetch "mrc" "$MRC_url" "$MRC_url_bkup" "$MRC_hash" \ + "$CONFIG_MRC_FILE" "curl" "$MRC_bin_hash" + [ -n "$CONFIG_REFCODE_BLOB_FILE" ] && \ + fetch "refcode" "$MRC_url" "$MRC_url_bkup" "$MRC_hash" \ + "$CONFIG_REFCODE_BLOB_FILE" "curl" "$REF_bin_hash" + [ -n "$CONFIG_LENOVO_TBFW_BIN" ] && \ + fetch "tbfw" "$TBFW_url" "$TBFW_url_bkup" "$TBFW_hash" \ + "$CONFIG_LENOVO_TBFW_BIN" "curl" "$TBFW_bin_hash" + [ -n "$CONFIG_FSP_M_FILE" ] && \ + fetch "fsp" "$CONFIG_FSP_FD_PATH" "$CONFIG_FSP_FD_PATH" \ + "$FSPFD_hash" "$CONFIG_FSP_M_FILE" "copy" "$FSPM_bin_hash" + [ -n "$CONFIG_FSP_S_FILE" ] && \ + fetch "fsp" "$CONFIG_FSP_FD_PATH" "$CONFIG_FSP_FD_PATH" \ + "$FSPFD_hash" "$CONFIG_FSP_S_FILE" copy "$FSPS_bin_hash"; : +} + +fetch() +{ + dl_type="$1" + dl="$2" + dl_bkup="$3" + dlsum="$4" + _dest="${5##*../}" + _pre_dest="$XBMK_CACHE/tmpdl/check" + dlop="$6" + binsum="$7" + + [ -z "$binsum" ] && err "binsum is empty (no checksum)" "fetch" "$@" + + _dl="$XBMK_CACHE/file/$dlsum" # internet file to extract from e.g. .exe + _dl_bin="$XBMK_CACHE/file/$binsum" # extracted file e.g. me.bin + + [ "$5" = "/dev/null" ] && return 0 # fetch/extract disabled + + # an extracted vendor file will be placed in pre_dest first, for + # verifying its checksum. if it matches, it is later moved to _dest + remkdir "${_pre_dest%/*}" "$appdir" + + # HACK: if grabbing fsp from coreboot, fix the path for lbmk + [ "$dl_type" = "fsp" ] && for bkup in "" "_bkup"; do + eval "dl$bkup=\"\${dl$bkup##*../}\"" + eval "_cdp=\"\$dl$bkup\"" + + [ ! -f "$_cdp" ] && \ + _cdp="$cbdir/$_cdp" + [ -f "$_cdp" ] && \ + eval "dl$bkup=\"\$_cdp\""; : + done; : + + # download the file (from the internet) to extract from: + xbget "$dlop" "$dl" "$dl_bkup" "$_dl" "$dlsum" + x_ rm -Rf "${_dl}_extracted" + + # skip extraction if a cached extracted file exists: + ( xbget copy "$_dl_bin" "$_dl_bin" "$_dest" "$binsum" 2>/dev/null ) || : + [ -f "$_dest" ] && \ + return 0 + + x_ mkdir -p "${_dest%/*}" + + [ "$dl_type" = "fsp" ] || \ + extract_archive "$_dl" "$appdir" || \ + [ "$dl_type" = "e6400vga" ] || \ + err "$_dest $dl_type: !extract" "fetch" "$@" + + x_ extract_$dl_type "$_dl" "$appdir" + set -u -e + + # some functions don't output directly to the given file, _pre_dest. + # instead, they put multiple files there, but we need the one matching + # the given hashsum. So, search for a matching file via bruteforce: + ( fx_ "mkdst $binsum" x_ find "${_pre_dest%/*}" -type f ) || : + + bad_checksum "$binsum" "$_dest" || \ + [ ! -f "$_dest" ] || return 0; : + + x_ rm -f "$_dest" + + [ -z "$binsum" ] && printf "WARNING: %s: no checksum\n" "$_dest" 1>&2 + err "Can't safely extract '$_dest', for board '$board'" "fetch" "$@" +} + +mkdst() +{ + if ! bad_checksum "$1" "$2"; then + x_ mv "$2" "$_dl_bin" + x_ cp "$_dl_bin" "$_dest" + exit 1 + fi + x_ rm -f "$2" +} + +extract_intel_me() +{ + mfs="" + _7ztest="$xbtmp/metmp/a" + _metmp="$xbtmp/me.bin" + + x_ rm -f "$_metmp" "$xbtmp/a" + x_ rm -Rf "$_7ztest" + + # maintain compatibility with older configs + # because in the past, shrink was assumed + [ -z "$MEshrink" ] && \ + MEshrink="y" + [ "$MEshrink" != "y" ] && [ "$MEshrink" != "n" ] && \ + err "MEshrink set badly on '$board' vendor config" + + if [ "$ME11bootguard" = "y" ]; then + if [ -z "$ME11delta" ] || [ -z "$ME11version" ] || \ + [ -z "$ME11sku" ] || [ -z "$ME11pch" ]; then + err "$board: ME11delta/ME11version/ME11sku/ME11pch" \ + "extract_intel_me" "$@" + fi + + x_ "$mk" -f deguard + fi + + set +u +e + + ( fx_ find_me x_ find "$xbmkpwd/$appdir" -type f ) || :; : + + set -u -e + + if [ "$ME11bootguard" != "y" ]; then + x_ mv "$_metmp" "$_pre_dest" + else + ( apply_deguard_hack ) || \ + err "deguard error on '$_dest'" "extract_intel_me" "$@"; : + fi +} + +# bruteforce Intel ME extraction. +# must be called inside a subshell. +find_me() +{ + [ -f "$_metmp" ] && exit 1 # me.bin found + [ -L "$1" ] && return 0 # symlinks disabled for security reasons + + _7ztest="${_7ztest}a" + + _r="-r" # re-locate modules + _trunc="-t" # -t: truncate the ME size + eval "`newvar _keep _pass`" # -k (keep fptr modules), -p (skip checks) + + [ "$ME11bootguard" = "y" ] && \ + mfs="-w MFS" + if [ "$MEclean" = "n" ]; then + MEshrink="n" + _keep="-k" # keep ME modules, don't delete anything + mfs="" # no MFS whitelist needed, due to -r: + fi + if [ "$MEclean" = "n" ] || [ "$MEshrink" != "y" ]; then + eval "`newvar _r _trunc`" + fi + [ "$MEcheck" = "n" ] && \ + _pass="-p" # skip fptr check + [ -n "$mfs" ] && \ + _r="" # cannot re-locate modules if using --whitelist MFS + + if "$mecleaner" $mfs $_r $_keep $_pass $_trunc -O "$xbtmp/a" \ + -M "$_metmp" "$1" || [ -f "$_metmp" ]; then + : # me.bin extracted from a full image with ifd, then shrunk + elif "$mecleaner" $mfs $_r $_pass $_keep $_trunc -O "$_metmp" "$1" || \ + [ -f "$_metmp" ]; then + : # me.bin image already present, and we shrunk it + elif "$me7updateparser" $_keep -O "$_metmp" "$1"; then + : # thinkpad sandybridge me.bin image e.g. x220/t420 + elif extract_archive "$1" "$_7ztest"; then + : # scan newly extracted archive within extracted archive + else + return 0 # can't extract, so try the next file + fi + + [ -f "$_metmp" ] && exit 1 # me.bin found + + ( fx_ find_me x_ find "$_7ztest" -type f ) || exit 1; : # 1==me found +} + +apply_deguard_hack() +{ + x_ cd src/deguard/default + + x_ ./finalimage.py --delta "data/delta/$ME11delta" \ + --version "$ME11version" --pch "$ME11pch" --sku "$ME11sku" \ + --fake-fpfs data/fpfs/zero --input "$_metmp" --output "$_pre_dest" +} + +extract_archive() +{ + innoextract "$1" -d "$2" || \ + python "$pfs_extract" "$1" -e || \ + 7z x "$1" -o"$2" || \ + "$bsdtar" -C "$2" -xf "$1" || \ + "$bsdunzip" "$1" -d "$2" || \ + return 1 + + [ -d "${_dl}_extracted" ] && \ + x_ cp -R "${_dl}_extracted" "$2"; : +} + +extract_kbc1126ec() +{ + ( extract_kbc1126ec_dump ) || \ + err "$board: can't extract kbc1126 fw" "extract_kbc1126ec" "$@" + + # throw error if either file is missing + x_ e "$appdir/ec.bin.fw1" f + x_ e "$appdir/ec.bin.fw2" f + + x_ cp "$appdir/"ec.bin.fw* "${_pre_dest%/*}/" +} + +extract_kbc1126ec_dump() +{ + x_ cd "$appdir/" + + mv Rompaq/68*.BIN ec.bin || \ + unar -D ROM.CAB Rom.bin || \ + unar -D Rom.CAB Rom.bin || \ + unar -D 68*.CAB Rom.bin || \ + err "!kbc1126 unar" "extract_kbc1126ec" "$@" + + [ -f "ec.bin" ] || x_ mv Rom.bin ec.bin + + x_ e ec.bin f + x_ "$kbc1126_ec_dump" ec.bin +} + +extract_e6400vga() +{ + set +u +e + + if [ -z "$E6400_VGA_offset" ] || [ -z "$E6400_VGA_romname" ]; then + err "$board: E6400_VGA_romname/E6400_VGA_offset unset" \ + "extract_e6400vga" "$@" + fi + + tail -c +$E6400_VGA_offset "$_dl" | gunzip > "$appdir/bios.bin" || : + + ( + x_ cd "$appdir" + x_ e "bios.bin" f + "$e6400_unpack" bios.bin || printf "TODO: fix dell extract util\n" + ) || err "can't extract e6400 vga rom" "extract_e6400vga" "$@" + + x_ cp "$appdir/$E6400_VGA_romname" "$_pre_dest" + + set -u -e +} + +extract_sch5545ec() +{ + # full system ROM (UEFI), to extract with UEFIExtract: + _bios="${_dl}_extracted/Firmware/1 $dlsum -- 1 System BIOS vA.28.bin" + + # this is the SCH5545 firmware, inside of the extracted UEFI ROM: + _sch5545ec_fw="$_bios.dump/4 7A9354D9-0468-444A-81CE-0BF617D890DF" + _sch5545ec_fw="$_sch5545ec_fw/54 D386BEB8-4B54-4E69-94F5-06091F67E0D3" + _sch5545ec_fw="$_sch5545ec_fw/0 Raw section/body.bin" # <-- this! + + x_ "$uefiextract" "$_bios" + x_ cp "$_sch5545ec_fw" "$_pre_dest" +} + +# Lenovo ThunderBolt firmware updates: +# https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t480-type-20l5-20l6/20l5/solutions/ht508988 +extract_tbfw() +{ + [ -z "$TBFW_size" ] && err "$board: TBFW_size unset" extract_tbfw "$@" + + fx_ copytb x_ find "$appdir" -type f -name "TBT.bin" +} + +copytb() +{ + if [ -f "$1" ] && [ ! -L "$1" ]; then + x_ dd if=/dev/null of="$1" bs=1 seek=$TBFW_size + x_ mv "$1" "$_pre_dest" + + return 1 + fi +} + +extract_fsp() +{ + x_ python "$cbdir/3rdparty/fsp/Tools/SplitFspBin.py" split -f "$1" \ + -o "${_pre_dest%/*}" -n "Fsp.fd" +} + +setvfile() +{ + [ -n "$vcfg" ] && for c in $checkvarschk + do + do_getvfile="n" + vcmd="[ \"\${$c}\" != \"/dev/null\" ] && [ -n \"\${$c}\" ]" + + eval "$vcmd && do_getvfile=\"y\"" + + [ "$do_getvfile" = "y" ] && \ + getvfile "$@" && \ + return 0; : + done && return 1; : +} + +getvfile() +{ + e "config/vendor/$vcfg/pkg.cfg" f missing && \ + return 1 + + . "config/vendor/$vcfg/pkg.cfg" || \ + err "Can't read 'config/vendor/$vcfg/pkg.cfg'" "getvfile" "$@" + + bootstrap + + if [ $# -gt 0 ]; then + getfiles # ./mk download + else # ./mk inject + fx_ prep x_ find "$tmpromdir" -mindepth 1 -maxdepth 1 \ + -type f -name "*.rom" + ( check_vendor_hashes ) || \ + err "$archive: Can't verify hashes" "getvfile" "$@"; : + fi + +} + +bootstrap() +{ + cbdir="src/coreboot/$tree" + kbc1126_ec_dump="$xbmkpwd/$cbdir/util/kbc1126/kbc1126_ec_dump" + cbfstool="elf/coreboot/$tree/cbfstool" + rmodtool="elf/coreboot/$tree/rmodtool" + + mecleaner="$xbmkpwd/$cbdir/util/me_cleaner/me_cleaner.py" + [ "$XBMKmecleaner" = "y" ] && \ + mecleaner="$xbmkpwd/src/me_cleaner/default/me_cleaner.py" + + x_ "$mk" -f coreboot "${cbdir##*/}" + x_ "$mk" -f me_cleaner + + forx 'x_ \"$mk\" -b %s' bios_extract biosutilities uefitool libarchive + + [ -d "${kbc1126_ec_dump%/*}" ] && \ + x_ make -C "$cbdir/util/kbc1126" + + if [ -n "$MRC_refcode_cbtree" ]; then + cbfstoolref="elf/coreboot/$MRC_refcode_cbtree/cbfstool" + x_ "$mk" -d coreboot "$MRC_refcode_cbtree"; : + fi +} + +prep() +{ + _xrom="$1" + _xromname="${1##*/}" + _xromnew="${_xrom%/*}/${_xromname#"$vfix"}" + + [ "$nuke" = "nuke" ] && \ + _xromnew="${_xrom%/*}/$vfix${_xrom##*/}" + + e "$_xrom" f missing && \ + return 0 + + [ -z "${_xromname#"$vfix"}" ] && \ + err "$_xromname / $vfix: name match" "prep" "$@" + + # Remove the prefix and 1-byte pad + if [ "${_xromname#"$vfix"}" != "$_xromname" ] \ + && [ "$nuke" != "nuke" ]; then + + unpad_one_byte "$_xrom" + x_ mv "$_xrom" "$_xromnew" + + _xrom="$_xromnew" + fi + + if [ "$nuke" = "nuke" ]; then + ( mksha512 "$_xrom" "vendorhashes" ) || err; : + fi + + add_vfiles "$_xrom" || return 1 # no need to insert files + + if [ "$nuke" = "nuke" ]; then + pad_one_byte "$_xrom" + x_ mv "$_xrom" "$_xromnew" + fi +} + +mksha512() +{ + eval "$build_sbase" + + [ "${1%/*}" != "$1" ] && \ + x_ cd "${1%/*}" + + x_ "$sha512sum" ./"${1##*/}" >> "$2" || \ + err "!sha512sum \"$1\" > \"$2\"" "mksha512" "$@" +} + +add_vfiles() +{ + rom="$1" + + if [ "$has_hashes" != "y" ] && [ "$nuke" != "nuke" ]; then + printf "'%s' has no hash file. Skipping.\n" "$archive" 1>&2 + return 1 + elif [ "$has_hashes" = "y" ] && [ "$nuke" = "nuke" ]; then + printf "'%s' has a hash file. Skipping nuke.\n" "$archive" 1>&2 + return 1 + fi + + [ -n "$CONFIG_HAVE_REFCODE_BLOB" ] && \ + vfile "fallback/refcode" "$CONFIG_REFCODE_BLOB_FILE" "stage" + [ "$CONFIG_HAVE_MRC" = "y" ] && \ + vfile "mrc.bin" "$CONFIG_MRC_FILE" "mrc" "0xfffa0000" + [ "$CONFIG_HAVE_ME_BIN" = "y" ] && \ + vfile IFD "$CONFIG_ME_BIN_PATH" me + [ -n "$CONFIG_KBC1126_FW1" ] && \ + vfile ecfw1.bin "$CONFIG_KBC1126_FW1" raw \ + "$CONFIG_KBC1126_FW1_OFFSET" + [ -n "$CONFIG_KBC1126_FW2" ] && \ + vfile ecfw2.bin "$CONFIG_KBC1126_FW2" raw \ + "$CONFIG_KBC1126_FW2_OFFSET" + [ -n "$CONFIG_VGA_BIOS_FILE" ] && [ -n "$CONFIG_VGA_BIOS_ID" ] && \ + vfile "pci$CONFIG_VGA_BIOS_ID.rom" "$CONFIG_VGA_BIOS_FILE" \ + optionrom + [ "$CONFIG_INCLUDE_SMSC_SCH5545_EC_FW" = "y" ] && \ + [ -n "$CONFIG_SMSC_SCH5545_EC_FW_FILE" ] && \ + vfile sch5545_ecfw.bin "$CONFIG_SMSC_SCH5545_EC_FW_FILE" raw + [ -z "$CONFIG_FSP_USE_REPO" ] && [ -z "$CONFIG_FSP_FULL_FD" ] && \ + [ -n "$CONFIG_FSP_M_FILE" ] && \ + vfile "$CONFIG_FSP_M_CBFS" "$CONFIG_FSP_M_FILE" fsp --xip + [ -z "$CONFIG_FSP_USE_REPO" ] && [ -z "$CONFIG_FSP_FULL_FD" ] && \ + [ -n "$CONFIG_FSP_S_FILE" ] && \ + vfile "$CONFIG_FSP_S_CBFS" "$CONFIG_FSP_S_FILE" fsp + + xchanged="y" + + printf "ROM image successfully patched: %s\n" "$rom" +} + +vfile() +{ + [ "$2" = "/dev/null" ] && return 0 + + cbfsname="$1" + _dest="${2##*../}" + blobtype="$3" + + _offset="" + + if [ "$blobtype" = "fsp" ] && [ $# -gt 3 ]; then + _offset="$4" + elif [ $# -gt 3 ] && _offset="-b $4" && [ -z "$4" ]; then + err "$rom: offset given but empty (undefined)" "vfile" "$@" + fi + + [ "$nuke" != "nuke" ] && \ + x_ e "$_dest" f + + if [ "$cbfsname" = "IFD" ]; then + if [ "$nuke" = "nuke" ]; then + x_ "$ifdtool" $ifdprefix --nuke $blobtype "$rom" \ + -O "$rom" + else + x_ "$ifdtool" $ifdprefix -i $blobtype:$_dest "$rom" \ + -O "$rom" + fi + elif [ "$nuke" = "nuke" ]; then + x_ "$cbfstool" "$rom" remove -n "$cbfsname" + elif [ "$blobtype" = "stage" ]; then + # the only stage we handle is refcode + + x_ rm -f "$xbtmp/refcode" + x_ "$rmodtool" -i "$_dest" -o "$xbtmp/refcode" + x_ "$cbfstool" "$rom" add-stage -f "$xbtmp/refcode" \ + -n "$cbfsname" -t stage + else + x_ "$cbfstool" "$rom" add -f "$_dest" -n "$cbfsname" \ + -t $blobtype $_offset + fi + + xchanged="y" +} + +# must be called from a subshell +check_vendor_hashes() +{ + eval "$build_sbase" + + x_ cd "$tmpromdir" + + if [ "$has_hashes" != "n" ] && [ "$nuke" != "nuke" ]; then + ( x_ "$sha512sum" -c "$hashfile" ) || \ + x_ sha1sum -c "$hashfile" + fi + + x_ rm -f "$hashfile" +} |