Skip to content

Commit ea0a599

Browse files
tlauriontlaurion
authored
Merge pull request #1570 from tlaurion/automate_blobs_download_xx30_xx20
Automate blobs download for xx30 xx20 boards
2 parents 449977b + 77f9933 commit ea0a599

File tree

32 files changed

+279
-186
lines changed

32 files changed

+279
-186
lines changed

‎.circleci/config.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ jobs:
9999
name: Download and neuter xx30 ME (keep generated GBE and extracted IFD in tree)
100100
# me_cleaner.py present under heads xx30 blobs dir comes from https://github.com/corna/me_cleaner/blob/43612a630c79f3bc6f2653bfe90dfe0b7b137e08/me_cleaner.py
101101
command: |
102-
./blobs/xx30/download_clean_me.sh -m $(readlink -f ./blobs/xx30/me_cleaner.py)
102+
./blobs/xx30/download_clean_me_manually.sh -m $(readlink -f ./blobs/xx30/me_cleaner.py)
103103
104104
- run:
105105
name: Download and extract t530 vbios roms for dgpu boards

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ $(error "Unexpected value of $$(CONFIG_TARGET_ARCH): $(CONFIG_TARGET_ARCH)")
8282
endif
8383

8484
ifneq "$(BOARD_TARGETS)" ""
85-
include targets/$(BOARD_TARGETS).mk
85+
include $(foreach TARGET,$(BOARD_TARGETS),targets/$(TARGET).mk)
8686
endif
8787

8888
# Create directories if they don't already exist

‎blobs/xx20/download_parse_me.sh

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,20 @@ FINAL_ME_BIN_SHA256SUM="1eef6716aa61dd844d58eca15a85faa1bf5f82715defd30bd3373e79
66
ME_EXE_SHA256SUM="48f18d49f3c7c79fa549a980f14688bc27c18645f64d9b6827a15ef5c547d210 83rf46ww.exe"
77
ME7_5M_UPD_PRODUCTION_SHA256SUM="760b0776b99ba94f56121d67c1f1226c77f48bd3b0799e1357a51842c79d3d36 app/ME7_5M_UPD_Production.bin"
88

9+
if [ -e "$BLOBDIR/me.bin" ]; then
10+
echo "$BLOBDIR/me.bin found..."
11+
if ! echo "$FINAL_ME_BIN_SHA256SUM" | sha256sum --check; then
12+
echo "$BLOBDIR/me.bin doesn't pass integrity validation. Continuing..."
13+
rm -f "$BLOBDIR/me.bin"
14+
else
15+
echo "$BLOBDIR/me.bin already extracted and neutered outside of BUP"
16+
exit 0
17+
fi
18+
fi
919

1020
echo "### Creating temp dir"
1121
extractdir=$(mktemp -d)
12-
cd "$extractdir"
22+
cd "$extractdir" || exit 1
1323

1424
echo "### Downloading https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/83rf46ww.exe..."
1525
wget https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/83rf46ww.exe || { echo "ERROR: wget not found" && exit 1; }
@@ -23,13 +33,13 @@ echo "### Verifying expected hash of app/ME7_5M_UPD_Production.bin"
2333
echo "$ME7_5M_UPD_PRODUCTION_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on extracted binary..." && exit 1; }
2434

2535

26-
echo "###Generating neuter+deactivate+maximize reduction of ME on $bioscopy, outputting minimized ME under $BLOBDIR/me.bin... "
27-
python3 "$BLOBDIR/me7_update_parser.py" -O "$BLOBDIR/me.bin" app/ME7_5M_UPD_Production.bin || { echo "Failed to generate ME binary..." && exit 1; }
36+
echo "###Generating neuter+deactivate+maximize reduction of ME on app/ME7_5M_UPD_Production.bin, outputting minimized ME under $BLOBDIR/me.bin... "
37+
( python3 "$BLOBDIR/me7_update_parser.py" -O "$BLOBDIR/me.bin" app/ME7_5M_UPD_Production.bin ) || { echo "Failed to generate ME binary..." && exit 1; }
2838

2939
echo "### Verifying expected hash of me.bin"
3040
echo "$FINAL_ME_BIN_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on final binary..." && exit 1; }
3141

3242

3343
echo "###Cleaning up..."
34-
cd -
44+
cd - || exit 1
3545
rm -r "$extractdir"

‎blobs/xx30/download_clean_me.sh

Lines changed: 50 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -4,53 +4,56 @@ function printusage {
44
echo "Usage: $0 -m <me_cleaner>(optional)"
55
}
66

7-
BLOBDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
8-
9-
if [ "$#" -eq 0 ]; then printusage; fi
10-
11-
while getopts ":m:" opt; do
12-
case $opt in
13-
m)
14-
if [ -x "$OPTARG" ]; then
15-
MECLEAN="$OPTARG"
16-
fi
17-
;;
18-
esac
19-
done
20-
21-
FINAL_ME_BIN_SHA256SUM="c140d04d792bed555e616065d48bdc327bb78f0213ccc54c0ae95f12b28896a4 $BLOBDIR/me.bin"
22-
ME_EXE_SHA256SUM="f60e1990e2da2b7efa58a645502d22d50afd97b53a092781beee9b0322b61153 g1rg24ww.exe"
23-
ME8_5M_PRODUCTION_SHA256SUM="821c6fa16e62e15bc902ce2e958ffb61f63349a471685bed0dc78ce721a01bfa app/ME8_5M_Production.bin"
24-
25-
26-
if [ -z "$MECLEAN" ]; then
27-
MECLEAN=`command -v $BLOBDIR/../../build/x86/coreboot-*/util/me_cleaner/me_cleaner.py 2>&1|head -n1`
28-
if [ -z "$MECLEAN" ]; then
29-
echo "me_cleaner.py required but not found or specified with -m. Aborting."
30-
exit 1;
7+
ME_BIN_HASH="c140d04d792bed555e616065d48bdc327bb78f0213ccc54c0ae95f12b28896a4"
8+
9+
if [ -e "${output_dir}/me.bin" ]; then
10+
echo "me.bin already exists"
11+
if echo "${ME_BIN_HASH} ${output_dir}/me.bin" | sha256sum --check; then
12+
echo "SKIPPING: SHA256 checksum for me.bin matches."
13+
exit 0
3114
fi
15+
echo "me.bin exists but checksum doesn't match. Continuing..."
3216
fi
3317

34-
echo "### Creating temp dir"
35-
extractdir=$(mktemp -d)
36-
cd "$extractdir"
37-
38-
echo "### Downloading https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe..."
39-
wget https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe || { echo "ERROR: wget not found" && exit 1; }
40-
echo "### Verifying expected hash of g1rg24ww.exe"
41-
echo "$ME_EXE_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on downloaded binary..." && exit 1; }
42-
43-
echo "### Extracting g1rg24ww.exe..."
44-
innoextract ./g1rg24ww.exe || { echo "Failed calling innoextract. Tool installed on host?" && exit 1;}
45-
echo "### Verifying expected hash of app/ME8_5M_Production.bin"
46-
echo "$ME8_5M_PRODUCTION_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on extracted binary..." && exit 1; }
47-
48-
echo "###Applying me_cleaner to neuter+deactivate+maximize reduction of ME on $bioscopy, outputting minimized ME under $BLOBDIR/me.bin... "
49-
$MECLEAN -r -t -O "$BLOBDIR/me.bin" app/ME8_5M_Production.bin
50-
echo "### Verifying expected hash of me.bin"
51-
echo "$FINAL_ME_BIN_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on final binary..." && exit 1; }
52-
53-
54-
echo "###Cleaning up..."
55-
cd -
56-
rm -r "$extractdir"
18+
if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
19+
if [[ "${1:-}" == "--help" ]]; then
20+
usage
21+
else
22+
if [[ -z "${COREBOOT_DIR}" ]]; then
23+
echo "ERROR: No COREBOOT_DIR variable defined."
24+
exit 1
25+
fi
26+
27+
output_dir="$(realpath "${1:-./}")"
28+
29+
if [[ ! -f "${output_dir}/me.bin" ]]; then
30+
# Unpack Lenovo's Windows installer into a temporary directory and
31+
# extract the Intel ME blob.
32+
pushd "$(mktemp -d)" || exit
33+
34+
curl -O https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe
35+
innoextract g1rg24ww.exe
36+
37+
mv app/ME8_5M_Production.bin "${COREBOOT_DIR}/util/me_cleaner"
38+
rm -rf ./*
39+
popd || exit
40+
41+
# Neutralize and shrink Intel ME. Note that this doesn't include
42+
# --soft-disable to set the "ME Disable" or "ME Disable B" (e.g.,
43+
# High Assurance Program) bits, as they are defined within the Flash
44+
# Descriptor.
45+
# https://github.com/corna/me_cleaner/wiki/External-flashing#neutralize-and-shrink-intel-me-useful-only-for-coreboot
46+
pushd "${COREBOOT_DIR}/util/me_cleaner" || exit
47+
48+
python me_cleaner.py -r -t -O me_shrinked.bin ME8_5M_Production.bin
49+
rm -f ME8_5M_Production.bin
50+
mv me_shrinked.bin "${output_dir}/me.bin"
51+
popd || exit
52+
fi
53+
54+
if ! echo "${ME_BIN_HASH} ${output_dir}/me.bin" | sha256sum --check; then
55+
echo "ERROR: SHA256 checksum for me.bin doesn't match."
56+
exit 1
57+
fi
58+
fi
59+
fi

‎blobs/xx30/download_clean_me_manually.sh

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/bin/bash
2+
3+
function printusage {
4+
echo "Usage: $0 -m <me_cleaner>(optional)"
5+
}
6+
7+
BLOBDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
8+
FINAL_ME_BIN_SHA256SUM="c140d04d792bed555e616065d48bdc327bb78f0213ccc54c0ae95f12b28896a4 $BLOBDIR/me.bin"
9+
ME_EXE_SHA256SUM="f60e1990e2da2b7efa58a645502d22d50afd97b53a092781beee9b0322b61153 g1rg24ww.exe"
10+
ME8_5M_PRODUCTION_SHA256SUM="821c6fa16e62e15bc902ce2e958ffb61f63349a471685bed0dc78ce721a01bfa app/ME8_5M_Production.bin"
11+
12+
if [ "$#" -eq 0 ]; then printusage; fi
13+
14+
while getopts ":m:" opt; do
15+
case $opt in
16+
m)
17+
if [ -x "$OPTARG" ]; then
18+
MECLEAN="$OPTARG"
19+
fi
20+
;;
21+
*)
22+
;;
23+
esac
24+
done
25+
26+
if [ -e "$BLOBDIR/me.bin" ]; then
27+
echo "$BLOBDIR/me.bin found..."
28+
if ! echo "$FINAL_ME_BIN_SHA256SUM" | sha256sum --check; then
29+
echo "$BLOBDIR/me.bin doesn't pass integrity validation. Continuing..."
30+
rm -f "$BLOBDIR/me.bin"
31+
else
32+
echo "$BLOBDIR/me.bin already extracted and neutered outside of ROMP and BUP"
33+
exit 0
34+
fi
35+
fi
36+
37+
if [ -z "$MECLEAN" ]; then
38+
MECLEAN=$(command -v "$BLOBDIR/../../build/x86/coreboot-"*/util/me_cleaner/me_cleaner.py 2>&1 | head -n1)
39+
if [ -z "$MECLEAN" ]; then
40+
echo "me_cleaner.py required but not found or specified with -m. Aborting."
41+
exit 1
42+
fi
43+
fi
44+
45+
echo "### Creating temp dir"
46+
extractdir=$(mktemp -d)
47+
cd "$extractdir" || exit
48+
49+
echo "### Downloading https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe..."
50+
wget https://download.lenovo.com/pccbbs/mobiles/g1rg24ww.exe || { echo "ERROR: wget not found" && exit 1; }
51+
echo "### Verifying expected hash of g1rg24ww.exe"
52+
echo "$ME_EXE_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on downloaded binary..." && exit 1; }
53+
54+
echo "### Extracting g1rg24ww.exe..."
55+
innoextract ./g1rg24ww.exe || { echo "Failed calling innoextract. Tool installed on host?" && exit 1; }
56+
echo "### Verifying expected hash of app/ME8_5M_Production.bin"
57+
echo "$ME8_5M_PRODUCTION_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on extracted binary..." && exit 1; }
58+
59+
bioscopy="some_value" # Assign a value to the bioscopy variable
60+
61+
echo "### Applying me_cleaner to neuter+deactivate+maximize reduction of ME on $bioscopy, outputting minimized ME under $BLOBDIR/me.bin... "
62+
"$MECLEAN" -r -t -O "$BLOBDIR/me.bin" app/ME8_5M_Production.bin
63+
echo "### Verifying expected hash of me.bin"
64+
echo "$FINAL_ME_BIN_SHA256SUM" | sha256sum --check || { echo "Failed sha256sum verification on final binary..." && exit 1; }
65+
66+
echo "### Cleaning up..."
67+
cd - >/dev/null
68+
69+
rm -r "$extractdir"

‎boards/UNTESTED_t520-hotp-maximized/UNTESTED_t520-hotp-maximized.config

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ CONFIG_PCIUTILS=y
2929
CONFIG_IO386=y
3030
export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
3131

32-
3332
#Remote attestation support
3433
#TPM based requirements
3534
export CONFIG_TPM=y
@@ -64,6 +63,5 @@ export CONFIG_BOOT_DEV="/dev/sda1"
6463
export CONFIG_BOARD_NAME="ThinkPad T520-hotp-maximized"
6564
export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal:ich_spi_mode=hwseq"
6665

67-
# xx20 boards require of you initially call one of the following to habe gbe.bin ifd.bin and me.bin
68-
# - blobs/xx20/download_parse_me.sh
69-
# To download Lenovo update ME binary, neuter+deactivate ME, produce reduced IFD ME region and expended BIOS IFD region.
66+
#Include bits related to sandybridge ME blob download/neutering down to BUP
67+
BOARD_TARGETS := xx20_me_blobs

‎boards/UNTESTED_t520-maximized/UNTESTED_t520-maximized.config

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ CONFIG_PCIUTILS=y
2929
CONFIG_IO386=y
3030
export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
3131

32-
3332
#Remote attestation support
3433
#TPM based requirements
3534
export CONFIG_TPM=y
@@ -64,6 +63,5 @@ export CONFIG_BOOT_DEV="/dev/sda1"
6463
export CONFIG_BOARD_NAME="ThinkPad T520-maximized"
6564
export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal:ich_spi_mode=hwseq"
6665

67-
# xx20 boards require of you initially call one of the following to habe gbe.bin ifd.bin and me.bin
68-
# - blobs/xx20/download_parse_me.sh
69-
# To download Lenovo update ME binary, neuter+deactivate ME, produce reduced IFD ME region and expended BIOS IFD region.
66+
#Include bits related to sandybridge ME blob download/neutering down to BUP
67+
BOARD_TARGETS := xx20_me_blobs

‎boards/UNTESTED_t530-dgpu-hotp-maximized/UNTESTED_t530-dgpu-hotp-maximized.config

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -67,13 +67,15 @@ export CONFIG_BOOT_DEV="/dev/sda1"
6767
export CONFIG_BOARD_NAME="Thinkpad T530-dgpu-hotp-maximized"
6868
export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal"
6969

70-
# xx30-*-maximized boards require of you initially call one of the
71-
# following to have gbe.bin ifd.bin and me.bin
72-
# - blobs/xx30/download_clean_me.sh
73-
# To download Lenovo original ME binary, neuter+deactivate ME, produce
74-
# reduced IFD ME region and expanded BIOS IFD region.
75-
# - blobs/xx30/extract.sh
76-
# To extract from backuped 8M (bottom SPI) ME binary, GBE and IFD blobs.
70+
# Make the Coreboot build depend on the following 3rd party blobs:
71+
$(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: \
72+
$(pwd)/blobs/xx30/me.bin $(pwd)/blobs/xx30/10de,0def.rom $(pwd)/blobs/xx30/8086,0106.rom
73+
74+
#Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
75+
BOARD_TARGETS := xx30_me_blobs
76+
77+
$(pwd)/blobs/xx30/10de,0def.rom:
78+
$(pwd)/blobs/xx30/vbios_t530.sh
7779

7880
# Generate split 4MB top / 8MB bottom ROMs
79-
BOARD_TARGETS := split_8mb4mb
81+
BOARD_TARGETS += split_8mb4mb

‎boards/UNTESTED_t530-dgpu-maximized/UNTESTED_t530-dgpu-maximized.config

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -67,13 +67,15 @@ export CONFIG_BOOT_DEV="/dev/sda1"
6767
export CONFIG_BOARD_NAME="Thinkpad T530-dgpu-maximized"
6868
export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal"
6969

70-
# xx30-*-maximized boards require of you initially call one of the
71-
# following to have gbe.bin ifd.bin and me.bin
72-
# - blobs/xx30/download_clean_me.sh
73-
# To download Lenovo original ME binary, neuter+deactivate ME, produce
74-
# reduced IFD ME region and expanded BIOS IFD region.
75-
# - blobs/xx30/extract.sh
76-
# To extract from backuped 8M (bottom SPI) ME binary, GBE and IFD blobs.
70+
# Make the Coreboot build depend on the following 3rd party blobs:
71+
$(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: \
72+
$(pwd)/blobs/xx30/me.bin $(pwd)/blobs/xx30/10de,0def.rom $(pwd)/blobs/xx30/8086,0106.rom
73+
74+
#Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
75+
BOARD_TARGETS := xx30_me_blobs
76+
77+
$(pwd)/blobs/xx30/10de,0def.rom:
78+
$(pwd)/blobs/xx30/vbios_t530.sh
7779

7880
# Generate split 4MB top / 8MB bottom ROMs
79-
BOARD_TARGETS := split_8mb4mb
81+
BOARD_TARGETS += split_8mb4mb

‎boards/UNTESTED_t530-hotp-maximized/UNTESTED_t530-hotp-maximized.config

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -67,13 +67,8 @@ export CONFIG_BOOT_DEV="/dev/sda1"
6767
export CONFIG_BOARD_NAME="Thinkpad T530-hotp-maximized"
6868
export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal"
6969

70-
# xx30-*-maximized boards require of you initially call one of the
71-
# following to have gbe.bin ifd.bin and me.bin
72-
# - blobs/xx30/download_clean_me.sh
73-
# To download Lenovo original ME binary, neuter+deactivate ME, produce
74-
# reduced IFD ME region and expanded BIOS IFD region.
75-
# - blobs/xx30/extract.sh
76-
# To extract from backuped 8M (bottom SPI) ME binary, GBE and IFD blobs.
70+
#Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
71+
BOARD_TARGETS := xx30_me_blobs
7772

7873
# Generate split 4MB top / 8MB bottom ROMs
79-
BOARD_TARGETS := split_8mb4mb
74+
BOARD_TARGETS += split_8mb4mb

0 commit comments

Comments
 (0)