summaryrefslogtreecommitdiffstats
path: root/resources
diff options
context:
space:
mode:
Diffstat (limited to 'resources')
-rw-r--r--resources/utilities/ich9deblob/ich9deblob.c130
-rw-r--r--resources/utilities/ich9deblob/ich9desc.c20
-rw-r--r--resources/utilities/ich9deblob/ich9gbe.c16
3 files changed, 132 insertions, 34 deletions
diff --git a/resources/utilities/ich9deblob/ich9deblob.c b/resources/utilities/ich9deblob/ich9deblob.c
index 0d1768d..a2819bf 100644
--- a/resources/utilities/ich9deblob/ich9deblob.c
+++ b/resources/utilities/ich9deblob/ich9deblob.c
@@ -1,5 +1,8 @@
/*
- * ich9deblob.c
+ * main.c
+ * This file is part of the ich9deblob utility from the libreboot project
+ *
+ * Purpose: disable and remove the ME from ich9m/gm45 machines in coreboot.
*
* Copyright (C) 2014 Steve Shenton <sgsit@libreboot.org>
* Francis Rowe <info@gluglug.org.uk>
@@ -17,6 +20,25 @@
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
+
+/*
+ * Read a factory.rom dump (ich9m/gm45 machines) and
+ * modify the flash descriptor to remove all regions except descriptor,
+ * Gbe and BIOS. Set BIOS region to full size of the ROM image (after
+ * the flash descriptor and gbe). Basically, deblob the descriptor.
+ *
+ * This will will generate a concatenated descriptor+gbe dump suitable
+ * for use in libreboot. Currently tested: ThinkPad X200 (coreboot/libreboot)
+ */
+
+// See docs/hcl/x200_remove_me.html for info plus links to datasheet (also linked below)
+
+// Info about flash descriptor (read page 850 onwards):
+// * http://www.intel.co.uk/content/dam/doc/datasheet/io-controller-hub-9-datasheet.pdf
+
+// Info about Gbe region (read whole datasheet):
+// * http://www.intel.co.uk/content/dam/doc/application-note/i-o-controller-hub-9m-82567lf-lm-v-nvm-map-appl-note.pdf
+// * https://communities.intel.com/community/wired/blog/2010/10/14/how-to-basic-eeprom-checksums
#include <stdio.h>
#include <string.h>
@@ -25,16 +47,22 @@
#define DESCRIPTORREGIONSIZE 0x1000 // 4096 bytes / 4KiB
#define GBEREGIONSIZE 0x2000 // 8192 bytes / 8KiB
+// These will have a modified descriptor+gbe based on what's in the factory.rom
+// These will be joined into a single 12KiB buffer (descriptor, then gbe) and saved to a file
+// NOTE: The GBE region of 8K is actually 2x 4K regions in a single region; both 4K blocks can be identical (and by default, are)
+// The 2nd one is a "backup", but we don't know when it's used. perhaps it's used when the checksum on the first one does not match?
+// gbe checksum related functions
unsigned short GetChecksum(char* buffer, unsigned short desiredValue); // for GBe region (checksum calculation)
unsigned short GetRegionWord(int i, char* buffer); // used for getting each word needed to calculate said checksum
int main(int argc, char *argv[])
{
- // check compiler bit-packs in a compatible way
+
+ // descriptor region. Will have actual descriptor mapped to it (from the factory.rom dump)
struct DESCRIPTORREGIONRECORD descriptorRegion;
unsigned int descriptorRegionStructSize = sizeof(descriptorRegion);
- // basically, it is expected that this code will be used on x86
+ // check compiler bit-packs in a compatible way basically, it is expected that this code will be used on x86
if (DESCRIPTORREGIONSIZE != descriptorRegionStructSize){
printf("\nerror: compiler incompatibility: descriptor struct length is %i bytes (should be %i)\n", descriptorRegionStructSize, DESCRIPTORREGIONSIZE);
return 1;
@@ -56,10 +84,11 @@ int main(int argc, char *argv[])
}
printf("\nfactory.rom opened successfully\n");
// -----------------------------------------------
+
+ // Get the descriptor region dump from the factory.rom
// Create empty descriptor buffer (populated below)
char descriptorBuffer[DESCRIPTORREGIONSIZE];
-
// Extract the descriptor region from the factory.rom dump
// (goes in descriptorBuffer variable)
unsigned int readLen;
@@ -70,7 +99,6 @@ int main(int argc, char *argv[])
return 1;
}
printf("\ndescriptor region read successfully\n");
-
// copy descriptor buffer into descriptor struct memory
// descriptorRegion is an instance of a struct that actually
// defines the locations of all these variables in the descriptor,
@@ -78,16 +106,24 @@ int main(int argc, char *argv[])
// descriptor over the struct so that it can then be modified
// for libreboot's purpose
memcpy(&descriptorRegion, &descriptorBuffer, DESCRIPTORREGIONSIZE);
+
+ // -----------------------------------------------------------------------------------------------
+
+ // Get the gbe region dump from the factory.rom
// get original GBe region location
// (it will be moved to the beginning of the flash, after the descriptor region)
- unsigned int flRegionBitShift = 12;
+ unsigned int flRegionBitShift = 12;// bits 12-24 are represented.
+ // note for example, gbeRegionLocation is set to <<12 of actual address (in C). this is how the addresses
+ // are stored in the descriptor.
unsigned int gbeRegionLocation = descriptorRegion.regionSection.flReg3.BASE << flRegionBitShift;
+ // Set offset so that we can read the data from
+ // the gbe region
fseek(fp, gbeRegionLocation, SEEK_SET);
-
+ // data will go in here
char gbeBuffer[GBEREGIONSIZE];
-
+ // Read the gbe data from the factory.rom and put it in gbeBuffer
readLen = fread(gbeBuffer, sizeof(char), GBEREGIONSIZE, fp);
if (GBEREGIONSIZE != readLen)
{
@@ -95,6 +131,8 @@ int main(int argc, char *argv[])
return 1;
}
+ // -----------------------------------------------------------------------------------------------
+
// Get size of ROM image
// This is needed for relocating the BIOS region (per descriptor)
fseek(fp, 0L, SEEK_END);
@@ -103,43 +141,69 @@ int main(int argc, char *argv[])
printf("\nfactory.rom size: [%i] bytes\n", romSize);
fclose(fp);
+
+ // -----------------------------------------------------------------------------------------------
+ // debugging
printf("\nOriginal Descriptor start block: %08x ; Descriptor end block: %08x\n", descriptorRegion.regionSection.flReg0.BASE << flRegionBitShift, descriptorRegion.regionSection.flReg0.LIMIT << flRegionBitShift);
printf("Original BIOS start block: %08x ; BIOS end block: %08x\n", descriptorRegion.regionSection.flReg1.BASE << flRegionBitShift, descriptorRegion.regionSection.flReg1.LIMIT << flRegionBitShift);
printf("Original ME start block: %08x ; ME end block: %08x\n", descriptorRegion.regionSection.flReg2.BASE << flRegionBitShift, descriptorRegion.regionSection.flReg2.LIMIT << flRegionBitShift);
printf("Original GBe start block: %08x ; GBe end block: %08x\n", gbeRegionLocation, descriptorRegion.regionSection.flReg3.LIMIT << flRegionBitShift);
- // set number of regions from 4 -> 2 (0 based)
+ // Now we need to modify the descriptor so that the ME can be excluded
+ // from the final ROM image (libreboot one) after adding the modified
+ // descriptor+gbe. Refer to libreboot docs for details: docs/hcl/x200_remove_me.html
+
+ // set number of regions from 4 -> 2 (0 based, so 4 means 5 and 2
+ // means 3. We want 3 regions: descriptor, gbe and bios, in that order)
descriptorRegion.flMaps.flMap0.NR = 2;
- // make descriptor writable from OS.
+ // make descriptor writable from OS. This is that the user can run:
+ // sudo ./flashrom -p internal:laptop=force_I_want_a_brick
+ // from the OS, without relying an an external SPI flasher, while
+ // being able to write to the descriptor region (locked by default,
+ // until making the change below):
descriptorRegion.masterAccessSection.flMstr1.fdRegionWriteAccess = 1;
// relocate BIOS region and increase size to fill image
- descriptorRegion.regionSection.flReg1.BASE = 3;
- descriptorRegion.regionSection.flReg1.LIMIT = ((romSize / 0x1000) - 1);
-
- // set ME region size to 0
- descriptorRegion.regionSection.flReg2.BASE = 0xFFF;
+ descriptorRegion.regionSection.flReg1.BASE = 3; // 3<<12 is 12KiB, which is where BIOS region is to begin (after descriptor and gbe)
+ descriptorRegion.regionSection.flReg1.LIMIT = ((romSize >> flRegionBitShift) - 1);
+ // ^ for example, 8MB ROM, that's 8388608 bytes.
+ // ^ 8388608>>12 (or 8388608/4096) = 2048 bytes
+ // 2048 - 1 = 2047 bytes.
+ // This defines where the final 0x1000 (4KiB) page starts in the flash chip, because the hardware does:
+ // 2047<<12 (or 2047*4096) = 8384512 bytes, or 7FF000 bytes
+ // (it can't be 0x7FFFFF because of limited number of bits)
+
+ // set ME region size to 0 - the ME is a blob, we don't want it in libreboot
+ descriptorRegion.regionSection.flReg2.BASE = 0x1FFF; // setting 1FFF means setting size to 0. 1FFF<<12 is outside of the ROM image (8MB) size?
+ // ^ datasheet says to set this to 1FFF, but FFF was previously used and also worked.
descriptorRegion.regionSection.flReg2.LIMIT = 0;
-
- // relocate Gbe region
- descriptorRegion.regionSection.flReg3.BASE = 1;
+ // ^ 0<<12=0, so basically, the size is 0, and the base (1FFF>>12) is well outside the higher 8MB range.
+
+ // relocate Gbe region to begin at 4KiB (immediately after the flash descriptor)
+ descriptorRegion.regionSection.flReg3.BASE = 1; // 1<<12 is 4096, which is where the Gbe region is to begin (after the descriptor)
descriptorRegion.regionSection.flReg3.LIMIT = 2;
+ // ^ 2<<12=8192 bytes. So we are set it to size 8KiB after the first 4KiB in the flash chip.
- // set Platform region size to 0
- descriptorRegion.regionSection.flReg4.BASE = 0xFFF;
+ // set Platform region size to 0 - another blob that we don't want
+ descriptorRegion.regionSection.flReg4.BASE = 0x1FFF; // setting 1FFF means setting size to 0. 1FFF<<12 is outside of the ROM image (8MB) size?
+ // ^ datasheet says to set this to 1FFF, but FFF was previously used and also worked.
descriptorRegion.regionSection.flReg4.LIMIT = 0;
+ // ^ 0<<12=0, so basically, the size is 0, and the base (1FFF>>12) is well outside the higher 8MB range.
- // disable ME in ICHSTRAP0
+ // disable ME in ICHSTRAP0 - the ME is a blob, we don't want it in libreboot
descriptorRegion.ichStraps.ichStrap0.meDisable = 1;
// disable ME and TPM in MCHSTRAP0
- descriptorRegion.mchStraps.mchStrap0.meDisable = 1;
- descriptorRegion.mchStraps.mchStrap0.tpmDisable = 1;
+ descriptorRegion.mchStraps.mchStrap0.meDisable = 1; // ME is a blob. not wanted in libreboot.
+ descriptorRegion.mchStraps.mchStrap0.tpmDisable = 1; // not wanted in libreboot
- // disable ME, apart from chipset bugfixes (ME region still required)
- //descriptorRegion.mchStraps.mchStrap0.meAlternateDisable = 1;
+ // disable ME, apart from chipset bugfixes (ME region should first be re-enabled above)
+ // This is sort of like the CPU microcode updates, but for the chipset
+ // (commented out below here, since blobs go against libreboot's purpose,
+ // but may be interesting for others)
+ // descriptorRegion.mchStraps.mchStrap0.meAlternateDisable = 1;
// debugging
printf("\nRelocated Descriptor start block: %08x ; Descriptor end block: %08x\n", descriptorRegion.regionSection.flReg0.BASE << flRegionBitShift, descriptorRegion.regionSection.flReg0.LIMIT << flRegionBitShift);
@@ -147,19 +211,27 @@ int main(int argc, char *argv[])
printf("Relocated ME start block: %08x ; ME end block: %08x\n", descriptorRegion.regionSection.flReg2.BASE << flRegionBitShift, descriptorRegion.regionSection.flReg2.LIMIT << flRegionBitShift);
printf("Relocated GBe start block: %08x ; GBe end block: %08x\n", descriptorRegion.regionSection.flReg3.BASE << flRegionBitShift, descriptorRegion.regionSection.flReg3.LIMIT << flRegionBitShift);
+ // ----------------------------------------------------------------------------------------------------------------
+ // Convert the descriptor and gbe back to byte arrays, so that they
+ // can more easily be written to files:
+ // deblobbed descriptor region
char deblobbedDescriptorBuffer[DESCRIPTORREGIONSIZE];
memcpy(&deblobbedDescriptorBuffer, &descriptorRegion, DESCRIPTORREGIONSIZE);
+ // delete old file before continuing
remove(deblobbedDescriptorFilename);
+ // open new file for writing the deblobbed descriptor+gbe
fp = fopen(deblobbedDescriptorFilename, "ab");
+ // write the descriptor region into the first part
if (DESCRIPTORREGIONSIZE != fwrite(deblobbedDescriptorBuffer, sizeof(char), DESCRIPTORREGIONSIZE, fp))
{
printf("\nerror: writing descriptor region failed\n");
return 1;
}
+ // add gbe to the end of the file
if (GBEREGIONSIZE != fwrite(gbeBuffer, sizeof(char), GBEREGIONSIZE, fp))
{
printf("\nerror: writing GBe region failed\n");
@@ -173,17 +245,20 @@ int main(int argc, char *argv[])
// calculate the 0x3F'th 16-bit uint to make the desired final checksum for GBe
// observed values (from actual factory.rom dumps) 0xBABA 0x3ABA 0x34BA. spec defined as 0xBABA.
// theoretically, this could be any l33t speak variation of BABA, eg 3434 or BA34, and so on, but this is untested. so far.
- // 40BA was also observed in another factory dump for another X200 - this is not l33t speak.
+ // 40BA was also observed in another factory dump for another X200 - this is l33t speak for aoba, not baba....
// maybe only the 8 least significant bits are checked? or something deeper than that
+ // it will need to be tested if those gbe regions that use something other than baba
+ // will also work with the checksum changed to match baba (per datasheets)
unsigned short gbeCalculatedChecksum = GetChecksum(gbeBuffer, 0xBABA);
// get the actual 0x3F'th 16-bit uint that was already in the supplied (pre-compiled) region data
- unsigned short gbeChecksum = GetRegionWord(0x3F, gbeBuffer);
+ unsigned short gbeChecksum = GetRegionWord(0x3F, gbeBuffer); // from the original factory.rom
printf("\ncalculated Gbe checksum: 0x%hx actual GBe checksum: 0x%hx\n", gbeCalculatedChecksum, gbeChecksum);
return 0;
}
+// checksum calculation for gbe region (algorithm based on datasheet)
unsigned short GetChecksum(char* regionData, unsigned short desiredValue)
{
unsigned short regionWord;
@@ -197,7 +272,6 @@ unsigned short GetChecksum(char* regionData, unsigned short desiredValue)
checksum = desiredValue - checksum;
return checksum;
}
-
// Read a 16-bit unsigned int from a supplied region buffer
unsigned short GetRegionWord(int index, char* regionData)
{
diff --git a/resources/utilities/ich9deblob/ich9desc.c b/resources/utilities/ich9deblob/ich9desc.c
index c3e1edf..b852497 100644
--- a/resources/utilities/ich9deblob/ich9desc.c
+++ b/resources/utilities/ich9deblob/ich9desc.c
@@ -1,5 +1,6 @@
/*
* ich9desc.c
+ * This file is part of the ich9deblob utility from the libreboot project
*
* Copyright (C) 2014 Steve Shenton <sgsit@libreboot.org>
* Francis Rowe <info@gluglug.org.uk>
@@ -17,18 +18,37 @@
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
+
+// Purpose: provide struct representing descriptor region.
+// Map actual buffers of this regions, directly to instances of these
+// structs. This makes working with descriptor really easy.
+
+// bit fields used, corresponding to datasheet. See links to datasheets
+// and documentation in ich9deblob.c
struct FLVALSIG{
unsigned int signature;
};
struct FLMAP0 {
+ // least signicant bits
unsigned char FCBA : 8;
unsigned char NC : 2;
unsigned char : 6;
+ // ^^^^ unnamed members like these represent unused bits (per datasheet).
+ // the same applies for all structs in this file.
unsigned char FRBA : 8;
unsigned char NR : 3;
unsigned char : 5;
+ // most significant bits.
+
+ // the datasheet lists msb's first and lsb's last, in each table.
+ // meanwhile, x86 gcc treats the members at the top of the struct as lsb's
+ // and at the bottom of the struct, the members there are msb's. The same
+ // fact applies to all the other structs below.
+
+ // non-x86 (and/or non-gcc) is untested
+ // little endian assumed
};
struct FLMAP1 {
diff --git a/resources/utilities/ich9deblob/ich9gbe.c b/resources/utilities/ich9deblob/ich9gbe.c
index 69eb9ca..b6d279b 100644
--- a/resources/utilities/ich9deblob/ich9gbe.c
+++ b/resources/utilities/ich9deblob/ich9gbe.c
@@ -18,12 +18,16 @@
*/
struct GBEREGIONRECORD {
- unsigned char macAddress[6];
- unsigned char otherStuff[120];
- unsigned short checkSum;
+ unsigned char macAddress[6]; // 0x03 words, or 0x06 bytes
+ unsigned char otherStuff[120]; // 0x3c words, or 0x7E bytes
+ unsigned short checkSum; // when added to the sum of all words above, this should be 0xBABA
unsigned char padding1[3968];
- unsigned char macAddress2[6];
- unsigned char otherStuff2[120];
- unsigned short checkSum2;
+ // Backup region:
+ // This is actually "main" on X200, since the real main has a bad checksum
+ // and other errors. You should do what you need on this one (if modifying
+ // lenovobios's gbe region) and then copy to main
+ unsigned char macAddress2[6]; // ditto
+ unsigned char otherStuff2[120]; // ditto
+ unsigned short checkSum2; // ditto
unsigned char padding2[3968];
};