1 files changed, 95 insertions, 158 deletions

diff --git a/include/inject.sh b/include/inject.sh
index 6b316729..f1ecb0d5 100644
--- a/include/inject.sh
+++ b/include/inject.sh
@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: GPL-3.0-only
+# SPD-License-Identifier: GPL-3.0-only
 # Copyright (c) 2022 Caleb La Grange <thonkpeasant@protonmail.com>
 # Copyright (c) 2022 Ferass El Hafidi <vitali64pmemail@protonmail.com>
 # Copyright (c) 2023-2025 Leah Rowe <leah@libreboot.org>
@@ -14,7 +14,7 @@ hashfiles="vendorhashes blobhashes" # blobhashes for backwards compatibility
 dontflash="!!! AN ERROR OCCURED! Please DO NOT flash if injection failed. !!!"
 vfix="DO_NOT_FLASH_YET._FIRST,_INJECT_FILES_VIA_INSTRUCTIONS_ON_LIBREBOOT.ORG_"
 vguide="https://libreboot.org/docs/install/ivy_has_common.html"
-tmpromdel="$xbmkpwd/tmp/DO_NOT_FLASH"
+tmpromdel="$xbmklocal/DO_NOT_FLASH"
 nvm="util/nvmutil/nvm"
 ifdtool="elf/ifdtool/default/ifdtool"
 
@@ -41,7 +41,7 @@ eval "`setvars "" has_hashes EC_hash DL_hash DL_url_bkup MRC_refcode_gbe vcfg \
 
 download()
 {
-	[ $# -gt 0 ] || $err "No argument given"
+	[ $# -gt 0 ] || err "No argument given"
 	export PATH="$PATH:/sbin"
 	board="$1" && readcfg && readkconfig && bootstrap && getfiles; :
 }
@@ -86,16 +86,13 @@ getfiles()
 	  "$E6400_VGA_DL_url_bkup" "$E6400_VGA_DL_hash" "$CONFIG_VGA_BIOS_FILE"
 	[ -z "$CONFIG_HAVE_MRC" ] || fetch "mrc" "$MRC_url" "$MRC_url_bkup" \
 	    "$MRC_hash" "$CONFIG_MRC_FILE"
+	[ -n "$CONFIG_REFCODE_BLOB_FILE" ] && fetch "refcode" "$MRC_url" \
+	    "$MRC_url_bkup" "$MRC_hash" "$CONFIG_REFCODE_BLOB_FILE"
 	[ -z "$CONFIG_LENOVO_TBFW_BIN" ] || fetch "tbfw" "$TBFW_url" \
 	    "$TBFW_url_bkup" "$TBFW_hash" "$CONFIG_LENOVO_TBFW_BIN"
-	#
-	# in the future, we might have libre fsp-s and then fsp-m.
-	# therefore, handle them separately, in case one of them is libre; if
-	# one of them was, the path wouldn't be set.
-	#
-	[ -z "$CONFIG_FSP_M_FILE" ] || fetch "fspm" "$CONFIG_FSP_FD_PATH" \
+	[ -z "$CONFIG_FSP_M_FILE" ] || fetch "fsp" "$CONFIG_FSP_FD_PATH" \
 	    "$CONFIG_FSP_FD_PATH" "$FSPFD_hash" "$CONFIG_FSP_M_FILE" copy
-	[ -z "$CONFIG_FSP_S_FILE" ] || fetch "fsps" "$CONFIG_FSP_FD_PATH" \
+	[ -z "$CONFIG_FSP_S_FILE" ] || fetch "fsp" "$CONFIG_FSP_FD_PATH" \
 	    "$CONFIG_FSP_FD_PATH" "$FSPFD_hash" "$CONFIG_FSP_S_FILE" copy; :
 }
 
@@ -109,51 +106,50 @@ fetch()
 
 	[ "$5" = "/dev/null" ] && return 0
 	_dl="$XBMK_CACHE/file/$dlsum"
-	if [ "$dl_type" = "fspm" ] || [ "$dl_type" = "fsps" ]; then
-		# HACK: if grabbing fsp from coreboot, fix the path for lbmk
-		for _cdl in dl dl_bkup; do
-			eval "$_cdl=\"\${$_cdl##*../}\"; _cdp=\"\$$_cdl\""
-			[ -f "$_cdp" ] || _cdp="$cbdir/$_cdp"
-			[ -f "$_cdp" ] && eval "$_cdl=\"$_cdp\""
-		done
-	fi
+	# HACK: if grabbing fsp from coreboot, fix the path for lbmk
+	[ "$dl_type" = "fsp" ] && for _cdl in dl dl_bkup; do
+		eval "$_cdl=\"\${$_cdl##*../}\"; _cdp=\"\$$_cdl\""
+		[ -f "$_cdp" ] || _cdp="$cbdir/$_cdp"
+		[ -f "$_cdp" ] && eval "$_cdl=\"$_cdp\""
+	done; :
 
 	dlop="curl" && [ $# -gt 5 ] && dlop="$6"
 	xbmkget "$dl" "$dl_bkup" "$_dl" "$dlsum" "$dlop"
 
-	rm -Rf "${_dl}_extracted" || $err "!rm ${_ul}_extracted. $dontflash"
+	rm -Rf "${_dl}_extracted" || err "!rm ${_ul}_extracted. $dontflash"
 	e "$_dest" f && return 0
 
 	x_ mkdir -p "${_dest%/*}"
 	remkdir "$appdir"
-	extract_archive "$_dl" "$appdir" "$dl_type" || \
-	    [ "$dl_type" = "e6400vga" ] || $err "$_dest $dl_type: !extract"
+	[ "$dl_type" = "fsp" ] || extract_archive "$_dl" "$appdir" || \
+	    [ "$dl_type" = "e6400vga" ] || err "$_dest $dl_type: !extract"
 
-	eval "extract_$dl_type"
+	x_ extract_$dl_type "$_dl" "$appdir"
 	set -u -e
-	e "$_dest" f missing && $err "!extract_$dl_type. $dontflash"; :
+	e "$_dest" f missing && err "!extract_$dl_type. $dontflash"; :
 }
 
 extract_intel_me()
 {
-	e "$mecleaner" f not && $err "$cbdir: me_cleaner missing. $dontflash"
+	e "$mecleaner" f not && err "$cbdir: me_cleaner missing. $dontflash"
 
 	cdir="$xbmkpwd/$appdir"
 	_me="$xbmkpwd/$_dest"
-	_metmp="$xbmkpwd/tmp/me.bin"
+	_metmp="$xbmklocal/me.bin"
 
 	mfs="" && [ "$ME11bootguard" = "y" ] && mfs="--whitelist MFS" && \
 	    chkvars ME11delta ME11version ME11sku ME11pch
 	[ "$ME11bootguard" = "y" ] && x_ ./mk -f deguard
 
-	x_ mkdir -p tmp
-
 	extract_intel_me_bruteforce
-	if [ "$ME11bootguard" = "y" ]; then
-		apply_me11_deguard_mod
-	else
-		mv "$_metmp" "$_me" || $err "!mv $_metmp $_me - $dontflash"
-	fi
+	[ "$ME11bootguard" != "y" ] && x_ mv "$_metmp" "$_me" && return 0
+
+	(
+	x_ cd src/deguard/
+	x_ ./finalimage.py --delta "data/delta/$ME11delta" --version \
+	    "$ME11version" --pch "$ME11pch" --sku "$ME11sku" \
+	    --fake-fpfs data/fpfs/zero --input "$_metmp" --output "$_me"
+	) || err "Error running deguard for $_me - $dontflash"; :
 }
 
 extract_intel_me_bruteforce()
@@ -167,11 +163,13 @@ extract_intel_me_bruteforce()
 	set +u +e
 	(
 	[ "${cdir#/a}" != "$cdir" ] && cdir="${cdir#/}"
-	cd "$cdir" || $err "extract_intel_me: !cd \"$cdir\" - $dontflash"
+	cd "$cdir" || err "extract_intel_me: !cd \"$cdir\" - $dontflash"
 	for i in *; do
-		e "$_metmp" f && break
+		c=0 && e "$_metmp" f && break
 		[ -L "$i" ] && continue
-		if [ -f "$i" ]; then
+		[ -e "$i" ] || continue
+		[ -d "$i" ] && extract_intel_me_bruteforce "$cdir/$i" && c=1
+		if [ $c -eq 0 ] && [ -f "$i" ]; then
 			_r="-r" && [ -n "$mfs" ] && _r=""
 			"$mecleaner" $mfs $_r -t -O "$sdir/vendorfile" \
 			    -M "$_metmp" "$i" && break
@@ -180,52 +178,20 @@ extract_intel_me_bruteforce()
 			_7ztest="${_7ztest}a"
 			extract_archive "$i" "$_7ztest" || continue
 			extract_intel_me_bruteforce "$cdir/$_7ztest"
-		elif [ -d "$i" ]; then
-			extract_intel_me_bruteforce "$cdir/$i"
-		else
-			continue
 		fi
 		cdir="$1"; [ "${cdir#/a}" != "$cdir" ] && cdir="${cdir#/}"
 		cd "$cdir" || :
 	done
 	) || :
-	rm -Rf "$sdir" || $err "extract_intel_me: !rm -Rf $sdir - $dontflash"
-}
-
-apply_me11_deguard_mod()
-{
-	(
-	x_ cd src/deguard/
-	x_ ./finalimage.py --delta "data/delta/$ME11delta" \
-	    --version "$ME11version" \
-	    --pch "$ME11pch" --sku "$ME11sku" --fake-fpfs data/fpfs/zero \
-	    --input "$_metmp" --output "$_me"
-	) || $err "Error running deguard for $_me - $dontflash"
+	rm -Rf "$sdir" || err "extract_intel_me: !rm -Rf $sdir - $dontflash"
 }
 
 extract_archive()
 {
-	if [ $# -gt 2 ]; then
-		if [ "$3" = "fspm" ] || [ "$3" = "fsps" ]; then
-			decat_fspfd "$1" "$2"
-			return 0
-		fi
-	fi
-
 	innoextract "$1" -d "$2" || python "$pfs_extract" "$1" -e || 7z x \
 	    "$1" -o"$2" || unar "$1" -o "$2" || unzip "$1" -d "$2" || return 1
 
-	[ ! -d "${_dl}_extracted" ] || cp -R "${_dl}_extracted" "$2" || \
-	    $err "!mv '${_dl}_extracted' '$2' - $dontflash"; :
-}
-
-decat_fspfd()
-{
-	_fspfd="$1"
-	_fspdir="$2"
-	_fspsplit="$cbdir/3rdparty/fsp/Tools/SplitFspBin.py"
-
-	x_ $python "$_fspsplit" split -f "$_fspfd" -o "$_fspdir" -n "Fsp.fd"
+	[ ! -d "${_dl}_extracted" ] || x_ cp -R "${_dl}_extracted" "$2"; :
 }
 
 extract_kbc1126ec()
@@ -236,16 +202,14 @@ extract_kbc1126ec()
 	mv Rompaq/68*.BIN ec.bin || :
 	if [ ! -f "ec.bin" ]; then
 		unar -D ROM.CAB Rom.bin || unar -D Rom.CAB Rom.bin || \
-		    unar -D 68*.CAB Rom.bin || $err "kbc1126 unar failed"
+		    unar -D 68*.CAB Rom.bin || err "kbc1126 unar failed"
 		x_ mv Rom.bin ec.bin
 	fi
 	x_ e ec.bin f && x_ "$kbc1126_ec_dump" ec.bin
-	) || $err "$board: can't extract kbc1126 ec firmware - $dontflash"
+	) || err "$board: can't extract kbc1126 ec firmware - $dontflash"
 
 	x_ e "$appdir/ec.bin.fw1" f && x_ e "$appdir/ec.bin.fw2" f
-
-	cp "$appdir/"ec.bin.fw* "${_dest%/*}/" || \
-	    $err "!cp 1126ec $_dest - $dontflash"; :
+	x_ cp "$appdir/"ec.bin.fw* "${_dest%/*}/"
 }
 
 extract_e6400vga()
@@ -257,7 +221,7 @@ extract_e6400vga()
 	x_ cd "$appdir"
 	x_ e "bios.bin" f
 	"$e6400_unpack" bios.bin || printf "TODO: fix dell extract util\n"
-	) || $err "can't extract e6400 vga rom - $dontflosh"
+	) || err "can't extract e6400 vga rom - $dontflosh"
 	x_ cp "$appdir/$E6400_VGA_romname" "$_dest"
 }
 
@@ -270,7 +234,7 @@ extract_sch5545ec()
 	_sch5545ec_fw="$_sch5545ec_fw/54 D386BEB8-4B54-4E69-94F5-06091F67E0D3"
 	_sch5545ec_fw="$_sch5545ec_fw/0 Raw section/body.bin" # <-- this!
 
-	"$uefiextract" "$_bios" || $err "sch5545 !extract - $dontflash"
+	"$uefiextract" "$_bios" || err "sch5545 !extract - $dontflash"
 	x_ cp "$_sch5545ec_fw" "$_dest"
 }
 
@@ -278,35 +242,19 @@ extract_sch5545ec()
 # https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t480-type-20l5-20l6/20l5/solutions/ht508988
 extract_tbfw()
 {
-	chkvars TBFW_size # size in bytes, matching TBFW's flash IC
-	x_ mkdir -p tmp
-	x_ rm -f tmp/tb.bin
-	find "$appdir" -type f -name "TBT.bin" > "tmp/tb.txt" || \
-	    $err "extract_tbfw $_dest: Can't extract TBT.bin - $dontflash"
-	while read -r f; do
-		[ -f "$f" ] || continue
-		[ -L "$f" ] && continue
-		x_ cp "$f" "tmp/tb.bin"
-		break
-	done < "tmp/tb.txt"
-	x_ dd if=/dev/null of=tmp/tb.bin bs=1 seek=$TBFW_size
-	x_ cp "tmp/tb.bin" "$_dest"
-}
-
-extract_fspm()
-{
-	copy_fsp M; :
+	chkvars TBFW_size && fe_ copy_tbfw "$appdir" -type f -name "TBT.bin"
 }
 
-extract_fsps()
+copy_tbfw()
 {
-	copy_fsp S; :
+	[ -f "$1" ] && [ ! -L "$1" ] && x_ dd if=/dev/null of="$1" bs=1 \
+	    seek=$TBFW_size && x_ mv "$1" "$_dest" && return 1; :
 }
 
-# this copies the fsp s/m; re-base is handled by ./mk inject
-copy_fsp()
+extract_fsp()
 {
-	x_ cp "$appdir/Fsp_$1.fd" "$_dest"
+	x_ python "$cbdir/3rdparty/fsp/Tools/SplitFspBin.py" split -f "$1" \
+	    -o "$2" -n "Fsp.fd" && x_ cp "$appdir/"Fsp_*.fd "${_dest%/*}"
 }
 
 fail_inject()
@@ -322,15 +270,15 @@ fail_inject()
 inject()
 {
 	need_files="n"
-	err="fail_inject"
+	xbmk_err="fail_inject"
 	remkdir "$tmpromdel"
 
 	set +u +e
-	[ $# -lt 1 ] && $err "No options specified. - $dontflash"
+	[ $# -lt 1 ] && err "No options specified. - $dontflash"
 	eval "`setvars "" nukemode new_mac xchanged`"
 
 	archive="$1";
-	new_mac="??:??:??:??:??:??"
+	new_mac="xx:xx:xx:xx:xx:xx"
 
 	[ $# -gt 1 ] && case "$2" in
 	nuke)
@@ -338,12 +286,15 @@ inject()
 		nukemode="nuke" ;;
 	setmac)
 		[ $# -gt 2 ] && new_mac="$3" && \
-		    [ -z "$new_mac" ] && $err "Empty MAC address specified" ;;
-	*) $err "Unrecognised inject mode: '$2'"
+		    [ -z "$new_mac" ] && err "Empty MAC address specified" ;;
+	*) err "Unrecognised inject mode: '$2'"
 	esac
 	[ "$new_mac" = "keep" ] && new_mac=""
 
-	check_release "$archive" || $err "'$archive' is not a release archive"
+	[ -n "$new_mac" ] && [ "$new_mac" != "restore" ] && \
+		x_ make -C util/nvmutil clean && x_ make -C util/nvmutil
+
+	check_release "$archive" || err "'$archive' is not a release archive"
 
 	readcfg && need_files="y"
 	if [ "$need_files" = "y" ] || [ -n "$new_mac" ]; then
@@ -359,20 +310,20 @@ inject()
 
 check_release()
 {
-	[ -L "$archive" ] && $err "'$archive' is a symlink. $dontflash"
+	[ -L "$archive" ] && err "'$archive' is a symlink. $dontflash"
 	e "$archive" f missing && return 1
 
 	archivename="`basename "$archive"`"
-	[ -z "$archivename" ] && $err "Can't determine archive name. $dontflash"
+	[ -z "$archivename" ] && err "Can't determine archive name. $dontflash"
 
 	case "$archivename" in
 	*_src.tar.xz)
-		$err "'$archive' is a src archive, silly!" ;;
+		err "'$archive' is a src archive, silly!" ;;
 	grub_*|seagrub_*|custom_*|seauboot_*|seabios_withgrub_*)
 		return 1 ;;
 	*.tar.xz) _stripped_prefix="${archivename#*_}"
 		board="${_stripped_prefix%.tar.xz}" ;;
-	*) $err "'$archive': could not detect board type - $dontflash"
+	*) err "'$archive': could not detect board type - $dontflash"
 	esac; :
 }
 
@@ -390,8 +341,8 @@ readcfg()
 	[ -z "$vcfg" ] && return 1
 
 	vfile="config/vendor/$vcfg/pkg.cfg"
-	[ -L "$vfile" ] && $err "'$archive', '$board': $vfile is a symlink"
-	[ -f "$vfile" ] || $err "'$archive', '$board': $vfile doesn't exist"
+	[ -L "$vfile" ] && err "'$archive', '$board': $vfile is a symlink"
+	[ -f "$vfile" ] || err "'$archive', '$board': $vfile doesn't exist"
 
 	cbdir="src/coreboot/$tree"
 	cbfstool="elf/cbfstool/$tree/cbfstool"
@@ -406,7 +357,7 @@ readcfg()
 patch_release_roms()
 {
 	has_hashes="n"
-	tmpromdir="tmp/DO_NOT_FLASH/bin/$board"
+	tmpromdir="$xbmklocal/DO_NOT_FLASH/bin/$board"
 
 	remkdir "${tmpromdir%"/bin/$board"}"
 	x_ tar -xf "$archive" -C "${tmpromdir%"/bin/$board"}"
@@ -417,16 +368,8 @@ patch_release_roms()
 		    hashfile="$_hashes" && break; :
 	done
 
-	x_ mkdir -p "tmp" && [ -L "tmp/rom.list" ] && \
-	    $err "'$archive' -> tmp/rom.list is a symlink - $dontflash"
-
-	find "$tmpromdir" -maxdepth 1 -type f -name "*.rom" > "tmp/rom.list" \
-	    || $err "'$archive' -> Can't make tmp/rom.list - $dontflash"
-
 	if readkconfig; then
-		while read -r _xrom ; do
-			process_release_rom "$_xrom" || break
-		done < "tmp/rom.list"
+		fe_ prep_rom "$tmpromdir" -maxdepth 1 -type f -name "*.rom"
 		[ "$nukemode" != "nuke" ] || \
 			printf "Make sure you inserted vendor files: %s\n" \
 			    "$vguide" > "$tmpromdir/README.md" || :
@@ -437,14 +380,14 @@ patch_release_roms()
 
 	(
 	[ "$need_files" = "y" ] || exit 0
-	cd "$tmpromdir" || $err "patch '$archive': can't cd $tmpromdir"
+	cd "$tmpromdir" || err "patch '$archive': can't cd $tmpromdir"
 	# NOTE: For compatibility with older rom releases, defer to sha1
 	if [ "$has_hashes" = "y" ] && [ "$nukemode" != "nuke" ]; then
 		sha512sum --status -c "$hashfile" || \
 		    x_ sha1sum --status -c "$hashfile"
 		x_ rm -f "$hashfile"
 	fi
-	) || $err "'$archive' -> Can't verify vendor hashes. $dontflash"
+	) || err "'$archive' -> Can't verify vendor hashes. $dontflash"
 
 	[ -z "$new_mac" ] || modify_mac || printf "\nGbE not defined\n" 1>&2
 
@@ -454,13 +397,13 @@ patch_release_roms()
 	(
 	x_ cd "${tmpromdir%"/bin/$board"}"
 	mkrom_tarball "bin/$board"
-	) || $err "Cannot re-generate '$archive' - $dontflash"
+	) || err "Cannot re-generate '$archive' - $dontflash"
 
 	mv "${tmpromdir%"/bin/$board"}/bin/${relname}_${board}.tar.xz" \
-	    "$archive" || $err "'$archive' -> Can't overwrite - $dontflash"; :
+	    "$archive" || err "'$archive' -> Can't overwrite - $dontflash"; :
 }
 
-process_release_rom()
+prep_rom()
 {
 	_xrom="$1"
 	_xromname="${1##*/}"
@@ -468,16 +411,16 @@ process_release_rom()
 	[ "$nukemode" = "nuke" ] && _xromnew="${_xrom%/*}/$vfix${_xrom##*/}"
 
 	e "$_xrom" f missing && return 0
-	[ -z "${_xromname#"$vfix"}" ] && $err "$_xromname / $vfix: name match"
+	[ -z "${_xromname#"$vfix"}" ] && err "$_xromname / $vfix: name match"
 
 	# Remove the prefix and 1-byte pad
 	if [ "$nukemode" != "nuke" ] && \
 	    [ "${_xromname#"$vfix"}" != "$_xromname" ]; then
-		xromsize="$(expr $(stat -c '%s' "$_xrom") - 1)" || $err "!int"
-		[ $xromsize -lt 524288 ] && $err "too small, $xromsize: $_xrom"
+		xromsize="$(expr $(stat -c '%s' "$_xrom") - 1)" || err "!int"
+		[ $xromsize -lt 524288 ] && err "too small, $xromsize: $_xrom"
 
 		x_ dd if="$_xrom" of="$_xromnew" bs=$xromsize count=1
-		rm -f "$_xrom" || $err "Can't rm $_xrom - $dontflash"
+		rm -f "$_xrom" || err "Can't rm $_xrom - $dontflash"
 
 		_xrom="$_xromnew"
 	fi
@@ -488,7 +431,7 @@ process_release_rom()
 	[ "$nukemode" != "nuke" ] && return 0
 
 	# Rename the file, prefixing a warning saying not to flash
-	cat "$_xrom" config/data/coreboot/0 > "$_xromnew" || $err "!pad $_xrom"
+	cat "$_xrom" config/data/coreboot/0 > "$_xromnew" || err "!pad $_xrom"
 	x_ rm -f "$_xrom"
 }
 
@@ -538,11 +481,10 @@ insert()
 
 	_offset=""
 
-	if [ "$_t" = "fsp" ]; then
-		[ $# -gt 3 ] && _offset="$4"
-	else
-		[ $# -gt 3 ] && _offset="-b $4" && [ -z "$4" ] && \
-		    $err "insert $*, $rom: offset given but empty (undefined)"
+	if [ "$_t" = "fsp" ] && [ $# -gt 3 ]; then
+		_offset="$4"
+	elif [ $# -gt 3 ] && _offset="-b $4" && [ -z "$4" ]; then
+		err "insert $*, $rom: offset given but empty (undefined)"
 	fi
 
 	[ "$nukemode" = "nuke" ] || x_ e "$_dest" f
@@ -550,20 +492,19 @@ insert()
 	if [ "$cbfsname" = "IFD" ]; then
 		[ "$nukemode" = "nuke" ] || "$ifdtool" $ifdprefix -i \
 		    $_t:$_dest "$rom" -O "$rom" || \
-		    $err "failed: insert '$_t' '$_dest' on '$rom'"
+		    err "failed: insert '$_t' '$_dest' on '$rom'"
 		[ "$nukemode" != "nuke" ] || "$ifdtool" $ifdprefix --nuke $_t \
-		    "$rom" -O "$rom" || $err "$rom: !nuke IFD/$_t"
+		    "$rom" -O "$rom" || err "$rom: !nuke IFD/$_t"
 	elif [ "$nukemode" = "nuke" ]; then
 		x_ "$cbfstool" "$rom" remove -n "$cbfsname"
 	elif [ "$_t" = "stage" ]; then # the only stage we handle is refcode
-		x_ mkdir -p tmp
-		x_ rm -f "tmp/refcode"
-		"$rmodtool" -i "$_dest" -o "tmp/refcode" || "!reloc refcode"
-		"$cbfstool" "$rom" add-stage -f "tmp/refcode" -n "$cbfsname" \
-		    -t stage || $err "$rom: !add ref"
+		x_ rm -f "$xbmklocal/refcode"
+		"$rmodtool" -i "$_dest" -o "$xbmklocal/refcode" || "!reloc ref"
+		"$cbfstool" "$rom" add-stage -f "$xbmklocal/refcode" \
+		    -n "$cbfsname" -t stage || err "$rom: !add ref"
 	else
 		"$cbfstool" "$rom" add -f "$_dest" -n "$cbfsname" \
-		    -t $_t $_offset || $err "$rom !add $_t ($_dest)"
+		    -t $_t $_offset || err "$rom !add $_t ($_dest)"
 	fi
 	xchanged="y"; :
 }
@@ -572,22 +513,18 @@ modify_mac()
 {
 	[ -n "$CONFIG_GBE_BIN_PATH" ] || return 1
 
-	x_ mkdir -p tmp && x_ cp "${CONFIG_GBE_BIN_PATH##*../}" tmp/gbe
-	[ "$new_mac" != "restore" ] && x_ make -C util/nvmutil && \
-	    x_ "$nvm" tmp/gbe setmac "$new_mac"
+	x_ cp "${CONFIG_GBE_BIN_PATH##*../}" "$xbmklocal/gbe"
+	[ -n "$new_mac" ] && [ "$new_mac" != "restore" ] && \
+	    x_ "$nvm" "$xbmklocal/gbe" setmac "$new_mac"
 
-	find "$tmpromdir" -maxdepth 1 -type f -name "*.rom" > "tmp/rom.list" \
-	    || $err "'$archive' -> Can't make tmp/rom.list - $dontflash"
-
-	while read -r _xrom; do
-		e "$_xrom" f && xchanged="y" && x_ \
-		    "$ifdtool" $ifdprefix -i GbE:tmp/gbe "$_xrom" -O "$_xrom"
-	done < "tmp/rom.list"
+	fe_ newmac "$tmpromdir" -maxdepth 1 -type f -name "*.rom"
 
 	printf "\nGbE NVM written to '%s':\n" "$archive"
-	x_ "$nvm" tmp/gbe dump | grep -v "bytes read from file" || :
+	x_ "$nvm" "$xbmklocal/gbe" dump | grep -v "bytes read from file" || :
+}
 
-	[ "$new_mac" = "restore" ] && \
-		printf "\nDefault GbE file '%s' written, unmodified.\n" \
-		    "${CONFIG_GBE_BIN_PATH##*../}"; :
+newmac()
+{
+	e "$1" f && xchanged="y" && x_ \
+	    "$ifdtool" $ifdprefix -i GbE:"$xbmklocal/gbe" "$1" -O "$1"; :
 }