2023-06-13 11:09:01 +00:00
|
|
|
#!/usr/bin/env sh
|
2022-11-14 00:51:12 +00:00
|
|
|
|
|
|
|
|
# SPDX-FileCopyrightText: 2022 Caleb La Grange <thonkpeasant@protonmail.com>
|
2023-06-13 11:09:01 +00:00
|
|
|
# SPDX-FileCopyrightText: 2022 Ferass El Hafidi <vitali64pmemail@protonmail.com>
|
2023-04-23 04:52:16 +00:00
|
|
|
# SPDX-FileCopyrightText: 2023 Leah Rowe <info@minifree.org>
|
2022-11-14 00:51:12 +00:00
|
|
|
# SPDX-License-Identifier: GPL-3.0-only
|
|
|
|
|
|
2023-08-23 17:56:31 +00:00
|
|
|
. "include/err.sh"
|
|
|
|
|
|
2023-05-14 07:54:58 +00:00
|
|
|
sname=""
|
2023-05-14 04:42:59 +00:00
|
|
|
archive=""
|
|
|
|
|
_filetype=""
|
|
|
|
|
rom=""
|
|
|
|
|
board=""
|
|
|
|
|
modifygbe=""
|
|
|
|
|
new_mac=""
|
|
|
|
|
release=""
|
|
|
|
|
releasearchive=""
|
|
|
|
|
|
|
|
|
|
cbdir="coreboot/default"
|
|
|
|
|
cbcfgsdir="resources/coreboot"
|
2023-06-24 22:23:16 +00:00
|
|
|
ifdtool="cbutils/default/ifdtool"
|
|
|
|
|
cbfstool="cbutils/default/cbfstool"
|
2023-05-14 04:42:59 +00:00
|
|
|
nvmutil="util/nvmutil/nvm"
|
|
|
|
|
boarddir=""
|
|
|
|
|
pciromsdir="pciroms"
|
|
|
|
|
|
|
|
|
|
CONFIG_HAVE_MRC=""
|
|
|
|
|
CONFIG_HAVE_ME_BIN=""
|
|
|
|
|
CONFIG_ME_BIN_PATH=""
|
|
|
|
|
CONFIG_KBC1126_FIRMWARE=""
|
|
|
|
|
CONFIG_KBC1126_FW1=""
|
|
|
|
|
CONFIG_KBC1126_FW1_OFFSET=""
|
|
|
|
|
CONFIG_KBC1126_FW2=""
|
|
|
|
|
CONFIG_KBC1126_FW2_OFFSET=""
|
|
|
|
|
CONFIG_VGA_BIOS_FILE=""
|
|
|
|
|
CONFIG_VGA_BIOS_ID=""
|
|
|
|
|
CONFIG_GBE_BIN_PATH=""
|
NEW BOARD: Dell Precision T1650
Very nice ivybridge board that supports ECC RAM.
NOTE: I couldn't get onboard graphics working yet, but
this was confirmed working with a graphics card (in my
case nvidia quadra k420) booted in text mode on the SeaBIOS
payload. The GRUB payload also works, when loaded from SeaBIOS.
Therefore, this is a SeaBIOS-only board (as far as first payload
is concerned), but you can pick GRUB from the menu.
You could make it "GRUB-only" in practise by setting SeaBIOS
boot order to only load GRUB, and disable the SeaBIOS menu.
We refer to this as "SeaGRUB".
I've made lbmk use biosutilities and uefiextract, to
get at the SMSC SCH5545 Environmental Control (EC) firmware.
This firmware is needed for fan control. This is automatically
downloaded and extracted, from Dell UEFI firmware updates.
As with other blobs such as Intel ME, this firmware is then
scrubbed by the release build scripts. The blobutil "inject"
script can be used to re-insert it.
Of note: there is no fixed offset, but no other blobs to
be inserted in CBFS either, so the offset when re-inserting
on release ROMs should still be the same, and thus the ROM
checksums should match, when running blobutil inject.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-11 13:50:17 +00:00
|
|
|
CONFIG_INCLUDE_SMSC_SCH5545_EC_FW=""
|
|
|
|
|
CONFIG_SMSC_SCH5545_EC_FW_FILE=""
|
2023-05-14 04:42:59 +00:00
|
|
|
|
|
|
|
|
main()
|
|
|
|
|
{
|
2023-05-14 07:54:58 +00:00
|
|
|
sname="${0}"
|
|
|
|
|
|
2023-08-23 17:56:31 +00:00
|
|
|
[ $# -lt 1 ] && err "No options specified."
|
2023-08-27 13:14:49 +00:00
|
|
|
[ "${1}" = "listboards" ] && \
|
|
|
|
|
./build command options resources/coreboot && exit 0
|
2022-11-14 00:51:12 +00:00
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
archive="${1}"
|
|
|
|
|
|
|
|
|
|
while getopts r:b:m: option
|
|
|
|
|
do
|
2023-07-29 06:24:18 +00:00
|
|
|
case "${option}" in
|
|
|
|
|
r)
|
2023-08-21 18:41:49 +00:00
|
|
|
rom=${OPTARG} ;;
|
2023-07-29 06:24:18 +00:00
|
|
|
b)
|
2023-08-21 18:41:49 +00:00
|
|
|
board=${OPTARG} ;;
|
2023-05-14 04:42:59 +00:00
|
|
|
m)
|
|
|
|
|
modifygbe=true
|
2023-08-21 18:41:49 +00:00
|
|
|
new_mac=${OPTARG} ;;
|
2023-07-29 06:24:18 +00:00
|
|
|
esac
|
2023-05-14 04:42:59 +00:00
|
|
|
done
|
2022-11-14 00:51:12 +00:00
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
check_board
|
|
|
|
|
build_dependencies
|
|
|
|
|
inject_blobs
|
2023-08-16 23:43:34 +00:00
|
|
|
|
|
|
|
|
printf "Friendly reminder (this is *not* an error message):\n"
|
|
|
|
|
printf "Please always ensure that the files were inserted correctly.\n"
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
printf "Read: https://libreboot.org/docs/install/ivy_has_common.html\n"
|
2022-11-14 00:51:12 +00:00
|
|
|
}
|
|
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
check_board()
|
|
|
|
|
{
|
2023-08-27 08:25:50 +00:00
|
|
|
if ! check_release "${archive}" ; then
|
2023-08-21 18:41:49 +00:00
|
|
|
[ -f "${rom}" ] || \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "check_board: \"${rom}\" is not a valid path"
|
2023-08-21 18:41:49 +00:00
|
|
|
[ -z ${rom+x} ] && \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "check_board: no rom specified"
|
2023-08-21 18:41:49 +00:00
|
|
|
[ ! -z ${board+x} ] || \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
board=$(detect_board "${rom}")
|
2023-05-14 04:42:59 +00:00
|
|
|
else
|
|
|
|
|
release=true
|
|
|
|
|
releasearchive="${archive}"
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
board=$(detect_board "${archive}")
|
2022-11-14 00:51:12 +00:00
|
|
|
fi
|
|
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
boarddir="${cbcfgsdir}/${board}"
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
if [ ! -d "${boarddir}" ]; then
|
|
|
|
|
err "check_board: board ${board} not found"
|
|
|
|
|
fi
|
2022-11-14 00:51:12 +00:00
|
|
|
}
|
|
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
check_release()
|
|
|
|
|
{
|
2023-08-21 18:41:49 +00:00
|
|
|
[ -f "${archive}" ] || return 1
|
|
|
|
|
[ "${archive##*.}" = "xz" ] || return 1
|
|
|
|
|
printf "%s\n" "Release archive ${archive} detected"
|
2022-11-14 00:51:12 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
# This function tries to determine the board from the filename of the rom.
|
|
|
|
|
# It will only succeed if the filename is not changed from the build/download
|
2023-05-14 04:42:59 +00:00
|
|
|
detect_board()
|
|
|
|
|
{
|
2023-08-27 08:25:50 +00:00
|
|
|
path="${1}"
|
2023-04-03 00:06:46 +00:00
|
|
|
filename=$(basename ${path})
|
2022-11-14 00:51:12 +00:00
|
|
|
case ${filename} in
|
2023-07-29 06:24:18 +00:00
|
|
|
grub_*)
|
2023-08-21 18:41:49 +00:00
|
|
|
board=$(echo "${filename}" | cut -d '_' -f2-3) ;;
|
2023-07-29 06:24:18 +00:00
|
|
|
seabios_withgrub_*)
|
2023-08-21 18:41:49 +00:00
|
|
|
board=$(echo "${filename}" | cut -d '_' -f3-4) ;;
|
2023-07-29 06:24:18 +00:00
|
|
|
*.tar.xz)
|
2023-04-03 00:06:46 +00:00
|
|
|
_stripped_prefix=${filename#*_}
|
2023-08-21 18:41:49 +00:00
|
|
|
board="${_stripped_prefix%.tar.xz}" ;;
|
2023-07-29 06:24:18 +00:00
|
|
|
*)
|
2023-08-23 18:56:01 +00:00
|
|
|
err "detect_board: could not detect board type"
|
2022-11-14 00:51:12 +00:00
|
|
|
esac
|
2023-08-23 18:56:01 +00:00
|
|
|
[ -d "${boarddir}/" ] || \
|
|
|
|
|
err "detect_board: dir, ${boarddir}, doesn't exist"
|
2023-08-21 18:41:49 +00:00
|
|
|
printf '%s\n' "${board}"
|
2022-11-14 00:51:12 +00:00
|
|
|
}
|
|
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
build_dependencies()
|
|
|
|
|
{
|
2023-09-01 07:30:08 +00:00
|
|
|
[ -d "${cbdir}" ] || ./update project trees coreboot default || \
|
|
|
|
|
err "build_dependencies: could not download coreboot/default"
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
./build coreboot utils default || \
|
|
|
|
|
err "build_dependencies: could not build cbutils"
|
2023-08-17 10:55:38 +00:00
|
|
|
./update blobs download ${board} || \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "build_dependencies: Could not download blobs for ${board}"
|
2023-05-14 04:42:59 +00:00
|
|
|
}
|
2023-05-06 20:21:42 +00:00
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
inject_blobs()
|
|
|
|
|
{
|
|
|
|
|
if [ "${release}" = "true" ]; then
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
printf "patching release file\n"
|
2023-05-14 04:42:59 +00:00
|
|
|
patch_release_roms
|
|
|
|
|
else
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
patch_rom "${rom}" || \
|
|
|
|
|
err "inject_blobs: could not patch ${x}"
|
2023-04-03 00:06:46 +00:00
|
|
|
fi
|
|
|
|
|
}
|
|
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
patch_release_roms()
|
|
|
|
|
{
|
2023-04-03 00:06:46 +00:00
|
|
|
_tmpdir=$(mktemp -d "/tmp/${board}_tmpXXXX")
|
|
|
|
|
tar xf "${releasearchive}" -C "${_tmpdir}" || \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "patch_release_roms: could not extract release archive"
|
2023-05-14 04:42:59 +00:00
|
|
|
|
2023-08-27 08:25:50 +00:00
|
|
|
for x in "${_tmpdir}"/bin/*/*.rom ; do
|
2023-05-14 04:42:59 +00:00
|
|
|
echo "patching rom $x"
|
2023-08-27 08:25:50 +00:00
|
|
|
patch_rom "${x}" || err "patch_release_roms: could not patch ${x}"
|
2023-04-03 00:06:46 +00:00
|
|
|
done
|
|
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
(
|
2023-08-27 08:25:50 +00:00
|
|
|
cd "${_tmpdir}"/bin/*
|
2023-04-03 00:06:46 +00:00
|
|
|
sha1sum --status -c blobhashes || \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "patch_release_roms: ROMs did not match expected hashes"
|
2023-04-03 00:06:46 +00:00
|
|
|
)
|
|
|
|
|
|
2022-11-14 00:51:12 +00:00
|
|
|
if [ "${modifygbe}" = "true" ]; then
|
2023-08-27 08:25:50 +00:00
|
|
|
for x in "${_tmpdir}"/bin/*/*.rom ; do
|
|
|
|
|
modify_gbe "${x}"
|
2023-04-03 00:06:46 +00:00
|
|
|
done
|
|
|
|
|
fi
|
|
|
|
|
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
[ -d bin/release ] || mkdir -p bin/release || \
|
|
|
|
|
err "patch_release_roms: !mkdir -p bin/release"
|
|
|
|
|
mv "${_tmpdir}"/bin/* bin/release/ || \
|
|
|
|
|
err "patch_release_roms: !mv ${_tmpdir}/bin/* bin/release/"
|
|
|
|
|
|
|
|
|
|
printf "Success! Your ROMs are in bin/release\n"
|
2023-04-03 00:06:46 +00:00
|
|
|
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
rm -Rf "${_tmpdir}" || err "patch_release_roms: !rm -Rf ${_tmpdir}"
|
2023-04-03 00:06:46 +00:00
|
|
|
}
|
|
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
patch_rom()
|
|
|
|
|
{
|
|
|
|
|
rom="${1}"
|
|
|
|
|
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
no_config="printf \"No configs on target, %s\\n\" ${board} 1>&2; exit 1"
|
|
|
|
|
for x in "${boarddir}"/config/*; do
|
|
|
|
|
[ -f "${x}" ] && no_config=""
|
|
|
|
|
done
|
|
|
|
|
eval "${no_config}"
|
|
|
|
|
|
|
|
|
|
[ -f "${boarddir}/target.cfg" ] || \
|
|
|
|
|
err "patch_rom: file missing: ${boarddir}/target.cfg"
|
|
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
set -- "${boarddir}/config/"*
|
2023-08-31 16:16:54 +00:00
|
|
|
. "${1}" 2>/dev/null
|
2023-08-16 20:34:21 +00:00
|
|
|
. "${boarddir}/target.cfg"
|
2023-05-14 04:42:59 +00:00
|
|
|
|
2023-08-21 18:41:49 +00:00
|
|
|
[ "$CONFIG_HAVE_MRC" = "y" ] && \
|
2023-05-14 04:42:59 +00:00
|
|
|
inject_blob_intel_mrc "${rom}"
|
2023-08-21 18:41:49 +00:00
|
|
|
[ "${CONFIG_HAVE_ME_BIN}" = "y" ] && \
|
2023-05-14 04:42:59 +00:00
|
|
|
inject_blob_intel_me "${rom}"
|
2023-08-21 18:41:49 +00:00
|
|
|
[ "${CONFIG_KBC1126_FIRMWARE}" = "y" ] && \
|
2023-05-14 04:42:59 +00:00
|
|
|
inject_blob_hp_kbc1126_ec "${rom}"
|
2023-08-21 18:41:49 +00:00
|
|
|
[ "${CONFIG_VGA_BIOS_FILE}" != "" ] && \
|
|
|
|
|
[ "${CONFIG_VGA_BIOS_ID}" != "" ] && \
|
coreboot/e6400: support nvidia models
The same ROM images that you flash on Intel GPU variants,
are now flashed on Nvidia models. The same ROM will work
on both. If an Intel GPU variant is present, libgfxinit
is used, and the VGA ROM is used if an Nvidia GPU variant;
however, release ROMs will scrub the nvidia option ROM,
so release ROMs will only work on Intel GPUs unless you
run the blobutil inject command.
I decided to no longer have this under WIP, but to put
it in master. The issue with it pertains to video drivers,
which is not Libreboot's problem.
Nouveau crashes under Linux, so use "nomodeset" if it does.
The "nv" drivers in BSD systems work very well.
The nvidia model of E6400 isn't recommended for other
reasons, namely: poor thermal cooling (thermal pad on
the GPU) and that Nvidia GPU doesn't get very good
performance on any libre drivers anyway. The Intel GPU
variant is better, in terms of power efficiency and
software support; the intel variant also works with
native graphics initialisation in coreboot.
This board port already only enables SeaBIOS, which will
simply execute the VGA ROM. Blobutil already supports
reading the config, detecting that a VGA ROM is needed,
because that part of the WIP E6400 branch was already
merged in lbmk master.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-09-02 16:03:54 +00:00
|
|
|
inject_blob_dell_e6400_vgarom_nvidia "${rom}"
|
2023-08-21 18:41:49 +00:00
|
|
|
[ "${CONFIG_INCLUDE_SMSC_SCH5545_EC_FW}" = "y" ] && \
|
|
|
|
|
[ "${CONFIG_SMSC_SCH5545_EC_FW_FILE}" != "" ] && \
|
NEW BOARD: Dell Precision T1650
Very nice ivybridge board that supports ECC RAM.
NOTE: I couldn't get onboard graphics working yet, but
this was confirmed working with a graphics card (in my
case nvidia quadra k420) booted in text mode on the SeaBIOS
payload. The GRUB payload also works, when loaded from SeaBIOS.
Therefore, this is a SeaBIOS-only board (as far as first payload
is concerned), but you can pick GRUB from the menu.
You could make it "GRUB-only" in practise by setting SeaBIOS
boot order to only load GRUB, and disable the SeaBIOS menu.
We refer to this as "SeaGRUB".
I've made lbmk use biosutilities and uefiextract, to
get at the SMSC SCH5545 Environmental Control (EC) firmware.
This firmware is needed for fan control. This is automatically
downloaded and extracted, from Dell UEFI firmware updates.
As with other blobs such as Intel ME, this firmware is then
scrubbed by the release build scripts. The blobutil "inject"
script can be used to re-insert it.
Of note: there is no fixed offset, but no other blobs to
be inserted in CBFS either, so the offset when re-inserting
on release ROMs should still be the same, and thus the ROM
checksums should match, when running blobutil inject.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-11 13:50:17 +00:00
|
|
|
inject_blob_smsc_sch5545_ec "${rom}"
|
2023-08-21 18:41:49 +00:00
|
|
|
[ "${modifygbe}" = "true" ] && ! [ "${release}" = "true" ] && \
|
2023-08-27 08:25:50 +00:00
|
|
|
modify_gbe "${rom}"
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
|
|
|
|
|
printf "ROM image successfully patched: %s\n" "${rom}"
|
2023-05-14 04:42:59 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
inject_blob_intel_mrc()
|
|
|
|
|
{
|
|
|
|
|
rom="${1}"
|
2023-04-03 00:06:46 +00:00
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
printf 'adding mrc\n'
|
2023-04-03 00:06:46 +00:00
|
|
|
|
blobutil/inject: use x86 top-aligned mrc offset
the old code was specifing an absolute offset for
insertion of mrc.bin - cbfstool interprets anything
above 0x80000000 as top-aligned memory address in
x86, and anything below as an obsolute offset in
the flash, like with the old number
where a top-aligned address is provided to cbfstool,
the absolute position is calculated for the flash,
and cbfstool inserts it in the correct rom location
the benefit of this change is that the absolute
offset is now calculated automatically, which means
that the code will be correct even if the flash
size changes. for example, if 16MB flash is used
whereas 12MB is currently the default an support
haswell hardware
coreboot does not provide anything readably like
Kconfig, for extracting this value. it's baked
into the source code of coreboot, so you have to
find it. the correct location is hardcoded for
each platform, and always the same on each platform,
regardless of mainboard
2023-05-14 07:16:12 +00:00
|
|
|
# mrc.bin must be inserted at a specific offset. the only
|
|
|
|
|
# libreboot platform that needs it, at present, is haswell
|
|
|
|
|
|
|
|
|
|
# in cbfstool, -b values above 0x80000000 are interpreted as
|
|
|
|
|
# top-aligned x86 memory locations. this is converted into an
|
|
|
|
|
# absolute offset within the flash, and inserted accordingly
|
|
|
|
|
# at that offset into the ROM image file
|
|
|
|
|
|
|
|
|
|
# coreboot's own build system hardcodes the mrc.bin offset
|
|
|
|
|
# because there is only one correct location in memory, but
|
|
|
|
|
# it would be useful for lbmk if it could be easily scanned
|
|
|
|
|
# from Kconfig, with the option to change it where in practise
|
|
|
|
|
# it is not changed
|
|
|
|
|
|
|
|
|
|
# the hardcoded offset below is based upon reading of the coreboot
|
|
|
|
|
# source code, and it is *always* correct for haswell platform.
|
|
|
|
|
# TODO: this logic should be tweaked to handle more platforms
|
|
|
|
|
|
2023-08-27 08:25:50 +00:00
|
|
|
"${cbfstool}" "${rom}" add -f mrc/haswell/mrc.bin -n mrc.bin -t mrc \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
-b 0xfffa0000 || err "inject_blob_intel_mrc: cannot insert mrc.bin"
|
2022-11-14 00:51:12 +00:00
|
|
|
}
|
|
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
inject_blob_intel_me()
|
|
|
|
|
{
|
2023-05-14 07:31:59 +00:00
|
|
|
printf 'adding intel management engine\n'
|
|
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
rom="${1}"
|
2023-08-21 18:41:49 +00:00
|
|
|
[ -z ${CONFIG_ME_BIN_PATH} ] && \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "inject_blob_intel_me: CONFIG_ME_BIN_PATH not set"
|
2023-05-14 07:31:59 +00:00
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
_me_location=${CONFIG_ME_BIN_PATH#../../}
|
2023-08-21 18:41:49 +00:00
|
|
|
[ ! -f "${_me_location}" ] && \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "inject_blob_intel_me: per CONFIG_ME_BIN_PATH: file missing"
|
2023-05-14 07:31:59 +00:00
|
|
|
|
2023-08-27 08:25:50 +00:00
|
|
|
"${ifdtool}" -i me:"${_me_location}" "${rom}" -O "${rom}" || \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "inject_blob_intel_me: cannot insert me.bin"
|
2023-05-14 04:42:59 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
inject_blob_hp_kbc1126_ec()
|
|
|
|
|
{
|
|
|
|
|
rom="${1}"
|
|
|
|
|
|
|
|
|
|
_ec1_location="${CONFIG_KBC1126_FW1#../../}"
|
|
|
|
|
_ec1_offset="${CONFIG_KBC1126_FW1_OFFSET}"
|
|
|
|
|
_ec2_location="${CONFIG_KBC1126_FW2#../../}"
|
|
|
|
|
_ec2_offset="${CONFIG_KBC1126_FW2_OFFSET}"
|
|
|
|
|
|
|
|
|
|
printf "adding hp kbc1126 ec firmware\n"
|
|
|
|
|
|
|
|
|
|
if [ "${_ec1_offset}" = "" ] || [ "${_ec1_offset}" = "" ]; then
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "inject_blob_hp_kbc1126_ec: ${board}: offset not declared"
|
2023-05-14 04:42:59 +00:00
|
|
|
fi
|
|
|
|
|
if [ "${_ec1_location}" = "" ] || [ "${_ec2_location}" = "" ]; then
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "inject_blob_hp_kbc1126_ec: ${board}: EC path not declared"
|
2023-05-14 04:42:59 +00:00
|
|
|
fi
|
|
|
|
|
if [ ! -f "${_ec1_location}" ] || [ ! -f "${_ec2_location}" ]; then
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "inject_blob_hp_kbc1126_ec: ${board}: ecfw not downloaded"
|
2023-05-14 04:42:59 +00:00
|
|
|
fi
|
|
|
|
|
|
2023-08-27 08:25:50 +00:00
|
|
|
"${cbfstool}" "${rom}" add -f "${_ec1_location}" -n ecfw1.bin \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
-b ${_ec1_offset} -t raw || \
|
|
|
|
|
err "inject_blob_hp_kbc1126_ec: cannot insert ecfw1.bin"
|
2023-08-27 08:25:50 +00:00
|
|
|
"${cbfstool}" "${rom}" add -f "${_ec2_location}" -n ecfw2.bin \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
-b ${_ec2_offset} -t raw || \
|
|
|
|
|
err "inject_blob_hp_kbc1126_ec: cannot insert ecfw2.bin"
|
2023-05-14 04:42:59 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
inject_blob_dell_e6400_vgarom_nvidia()
|
|
|
|
|
{
|
|
|
|
|
rom="${1}"
|
|
|
|
|
|
|
|
|
|
_vga_location="${CONFIG_VGA_BIOS_FILE#../../}"
|
|
|
|
|
_vga_dir="${_vga_location%/*}"
|
|
|
|
|
_vga_filename="${_vga_location##*/}"
|
|
|
|
|
|
|
|
|
|
printf "adding pci option rom\n"
|
|
|
|
|
|
|
|
|
|
if [ "${_vga_dir}" != "${pciromsdir}" ]; then
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "inject_blob_dell_e6400vga: invalid pcirom dir: ${_vga_dir}"
|
2023-05-14 04:42:59 +00:00
|
|
|
fi
|
|
|
|
|
if [ ! -f "${_vga_location}" ]; then
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "inject_blob_dell_e6400vga: ${_vga_location} doesn't exist"
|
2023-05-14 04:42:59 +00:00
|
|
|
fi
|
|
|
|
|
|
2023-08-27 08:25:50 +00:00
|
|
|
"${cbfstool}" "${rom}" add -f "${_vga_location}" \
|
2023-08-23 18:56:01 +00:00
|
|
|
-n "pci${CONFIG_VGA_BIOS_ID}.rom" -t optionrom || \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "inject_blob_dell_e6400vga: cannot insert vga oprom"
|
2023-05-14 04:42:59 +00:00
|
|
|
}
|
|
|
|
|
|
NEW BOARD: Dell Precision T1650
Very nice ivybridge board that supports ECC RAM.
NOTE: I couldn't get onboard graphics working yet, but
this was confirmed working with a graphics card (in my
case nvidia quadra k420) booted in text mode on the SeaBIOS
payload. The GRUB payload also works, when loaded from SeaBIOS.
Therefore, this is a SeaBIOS-only board (as far as first payload
is concerned), but you can pick GRUB from the menu.
You could make it "GRUB-only" in practise by setting SeaBIOS
boot order to only load GRUB, and disable the SeaBIOS menu.
We refer to this as "SeaGRUB".
I've made lbmk use biosutilities and uefiextract, to
get at the SMSC SCH5545 Environmental Control (EC) firmware.
This firmware is needed for fan control. This is automatically
downloaded and extracted, from Dell UEFI firmware updates.
As with other blobs such as Intel ME, this firmware is then
scrubbed by the release build scripts. The blobutil "inject"
script can be used to re-insert it.
Of note: there is no fixed offset, but no other blobs to
be inserted in CBFS either, so the offset when re-inserting
on release ROMs should still be the same, and thus the ROM
checksums should match, when running blobutil inject.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-11 13:50:17 +00:00
|
|
|
inject_blob_smsc_sch5545_ec()
|
|
|
|
|
{
|
|
|
|
|
rom="${1}"
|
|
|
|
|
|
|
|
|
|
_sch5545ec_location="${CONFIG_SMSC_SCH5545_EC_FW_FILE#../../}"
|
|
|
|
|
|
|
|
|
|
if [ ! -f "${_sch5545ec_location}" ]; then
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "inject_blob_smsc_sch5545_ec: SCH5545 fw missing"
|
NEW BOARD: Dell Precision T1650
Very nice ivybridge board that supports ECC RAM.
NOTE: I couldn't get onboard graphics working yet, but
this was confirmed working with a graphics card (in my
case nvidia quadra k420) booted in text mode on the SeaBIOS
payload. The GRUB payload also works, when loaded from SeaBIOS.
Therefore, this is a SeaBIOS-only board (as far as first payload
is concerned), but you can pick GRUB from the menu.
You could make it "GRUB-only" in practise by setting SeaBIOS
boot order to only load GRUB, and disable the SeaBIOS menu.
We refer to this as "SeaGRUB".
I've made lbmk use biosutilities and uefiextract, to
get at the SMSC SCH5545 Environmental Control (EC) firmware.
This firmware is needed for fan control. This is automatically
downloaded and extracted, from Dell UEFI firmware updates.
As with other blobs such as Intel ME, this firmware is then
scrubbed by the release build scripts. The blobutil "inject"
script can be used to re-insert it.
Of note: there is no fixed offset, but no other blobs to
be inserted in CBFS either, so the offset when re-inserting
on release ROMs should still be the same, and thus the ROM
checksums should match, when running blobutil inject.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-11 13:50:17 +00:00
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
"${cbfstool}" "${rom}" add -f "${_sch5545ec_location}" \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
-n sch5545_ecfw.bin -t raw || \
|
|
|
|
|
err "inject_blob_smsc_sch5545_ec: can't insert sch5545_ecfw.bin"
|
NEW BOARD: Dell Precision T1650
Very nice ivybridge board that supports ECC RAM.
NOTE: I couldn't get onboard graphics working yet, but
this was confirmed working with a graphics card (in my
case nvidia quadra k420) booted in text mode on the SeaBIOS
payload. The GRUB payload also works, when loaded from SeaBIOS.
Therefore, this is a SeaBIOS-only board (as far as first payload
is concerned), but you can pick GRUB from the menu.
You could make it "GRUB-only" in practise by setting SeaBIOS
boot order to only load GRUB, and disable the SeaBIOS menu.
We refer to this as "SeaGRUB".
I've made lbmk use biosutilities and uefiextract, to
get at the SMSC SCH5545 Environmental Control (EC) firmware.
This firmware is needed for fan control. This is automatically
downloaded and extracted, from Dell UEFI firmware updates.
As with other blobs such as Intel ME, this firmware is then
scrubbed by the release build scripts. The blobutil "inject"
script can be used to re-insert it.
Of note: there is no fixed offset, but no other blobs to
be inserted in CBFS either, so the offset when re-inserting
on release ROMs should still be the same, and thus the ROM
checksums should match, when running blobutil inject.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-11 13:50:17 +00:00
|
|
|
}
|
|
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
modify_gbe()
|
|
|
|
|
{
|
|
|
|
|
printf "changing mac address in gbe to ${new_mac}\n"
|
|
|
|
|
|
2023-08-27 08:25:50 +00:00
|
|
|
rom="${1}"
|
2023-05-14 07:35:34 +00:00
|
|
|
|
2023-08-21 18:41:49 +00:00
|
|
|
[ -z ${CONFIG_GBE_BIN_PATH} ] && \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "modify_gbe: ${board}: CONFIG_GBE_BIN_PATH not set"
|
2023-05-14 07:35:34 +00:00
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
_gbe_location=${CONFIG_GBE_BIN_PATH#../../}
|
|
|
|
|
|
2023-08-21 18:41:49 +00:00
|
|
|
[ -f "${_gbe_location}" ] || \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "modify_gbe: CONFIG_GBE_BIN_PATH points to missing file"
|
2023-08-27 08:25:50 +00:00
|
|
|
[ -f "${nvmutil}" ] || \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
make -C util/nvmutil || err "modify_gbe: couldn't build nvmutil"
|
2022-11-14 00:51:12 +00:00
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
_gbe_tmp=$(mktemp -t gbeXXXX.bin)
|
2023-08-27 08:25:50 +00:00
|
|
|
cp "${_gbe_location}" "${_gbe_tmp}"
|
|
|
|
|
"${nvmutil}" "${_gbe_tmp}" setmac "${new_mac}" || \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "modify_gbe: ${board}: failed to modify mac address"
|
2023-04-03 00:06:46 +00:00
|
|
|
|
2023-08-27 08:25:50 +00:00
|
|
|
"${ifdtool}" -i GbE:"${_gbe_tmp}" "${rom}" -O "${rom}" || \
|
much, much stricter, more verbose error handling
lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.
also: in "fetch", remove the downloaded program
if fail() was called.
this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.
where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.
also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.
also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout
as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error
mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.
certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds
certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.
doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.
Signed-off-by: Leah Rowe <leah@libreboot.org>
2023-08-24 19:19:41 +00:00
|
|
|
err "modify_gbe: ${board}: cannot insert modified gbe.bin"
|
2023-05-14 04:42:59 +00:00
|
|
|
|
2023-08-27 08:25:50 +00:00
|
|
|
rm -f "${_gbe_tmp}"
|
2023-05-14 04:42:59 +00:00
|
|
|
}
|
2023-04-03 00:06:46 +00:00
|
|
|
|
2023-05-14 04:42:59 +00:00
|
|
|
usage()
|
|
|
|
|
{
|
|
|
|
|
cat <<- EOF
|
2023-08-17 10:55:38 +00:00
|
|
|
USAGE: ./update blobs inject -r [rom path] -b [boardname] -m [macaddress]
|
|
|
|
|
Example: ./update blobs inject -r x230_12mb.rom -b x230_12mb
|
2023-05-14 04:42:59 +00:00
|
|
|
|
|
|
|
|
Adding a macadress to the gbe is optional.
|
|
|
|
|
If the [-m] parameter is left blank, the gbe will not be touched.
|
|
|
|
|
|
2023-08-17 10:55:38 +00:00
|
|
|
Type './update blobs inject listboards' to get a list of valid boards
|
2023-05-14 04:42:59 +00:00
|
|
|
EOF
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
main $@
|