dasharo/dts-scripts
0
0
Fork 0
mirror of https://github.com/Dasharo/dts-scripts.git synced 2026-06-13 19:16:21 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #103 from Dasharo/mtl-fuse

Browse Source 
Mtl fuse
This commit is contained in:
Michał Iwanicki
2025-09-18 15:06:19 +02:00
committed by GitHub
parent a43e5fa745 2e0e836837
commit 2dd671ee06
3 changed files with 116 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/dts-environment.sh
+4
View File
@@ -44,6 +44,7 @@ REST_FIRM_OPT="3"
DPP_KEYS_OPT="4"
DPP_SUBMENU_OPT="5"
TRANSITION_OPT="6"
FUSE_OPT="7"
BACK_TO_MAIN_MENU_UP="Q"
BACK_TO_MAIN_MENU_DOWN="$(echo $BACK_TO_MAIN_MENU_UP | awk '{print tolower($0)}')"
REBOOT_OPT_UP="R"
@@ -174,6 +175,9 @@ declare BIOS_SIGN_LINK_COMM_CAP
declare BIOS_LINK_DPP_CAP
declare BIOS_HASH_LINK_DPP_CAP
declare BIOS_SIGN_LINK_DPP_CAP
declare EOM_LINK_COMM_CAP
declare EOM_HASH_LINK_COMM_CAP
declare EOM_SIGN_LINK_COMM_CAP
# Configs, are used in dasharo-deploy script:
CAN_INSTALL_BIOS="false"
HAVE_HEADS_FW="false"
include/dts-functions.sh
+53 -17
View File
@@ -391,6 +391,7 @@ board_config() {
esac
BIOS_LINK_COMM=${BIOS_LINK_COMM:-"$FW_STORE_URL/$DASHARO_REL_NAME/v$DASHARO_REL_VER/${DASHARO_REL_NAME}_v${DASHARO_REL_VER}.rom"}
EC_LINK_COMM=${EC_LINK_COMM:-"$FW_STORE_URL/$DASHARO_REL_NAME/v$DASHARO_REL_VER/${DASHARO_REL_NAME}_ec_v${DASHARO_REL_VER}.rom"}
[ -n "${EOM_PATH_COMM_CAP}" ] && EOM_LINK_COMM_CAP="${FW_STORE_URL}/${EOM_PATH_COMM_CAP}"
;;
"NovaCustom" | "ASRock Industrial")
if ! parse_and_verify_config "$SYSTEM_VENDOR" "$SYSTEM_MODEL" "$BOARD_MODEL"; then
@@ -667,6 +668,8 @@ board_config() {
[ -z "$BIOS_SIGN_LINK_DPP_CAP" ] && BIOS_SIGN_LINK_DPP_CAP="${BIOS_HASH_LINK_DPP_CAP}.sig"
[ -z "$EC_HASH_LINK_DPP_CAP" ] && EC_HASH_LINK_DPP_CAP="${EC_LINK_DPP_CAP}.sha256"
[ -z "$EC_SIGN_LINK_DPP_CAP" ] && EC_SIGN_LINK_DPP_CAP="${EC_HASH_LINK_DPP_CAP}.sig"
[ -z "$EOM_HASH_LINK_COMM_CAP" ] && EOM_HASH_LINK_COMM_CAP="${EOM_LINK_COMM_CAP}.sha256"
[ -z "$EOM_SIGN_LINK_COMM_CAP" ] && EOM_SIGN_LINK_COMM_CAP="${EOM_HASH_LINK_COMM_CAP}.sig"
rm -rf "$BOARD_CONFIG_PATH"
}
@@ -714,16 +717,30 @@ check_flash_chip() {
}
compare_versions() {
# compare_versions ver1 ver2
# return 1 if ver2 > ver1
# return 0 otherwise
local ver1=
local ver2=
local ver1="$1"
local ver2="$2"
if [ "$(semver_version_compare "$1" "$2")" -eq -1 ]; then
return 1
else
return 0
fi
}
semver_version_compare() {
# semver_version_compare ver1 ver2
# echo 0 if ver1 == ver2, 1 if ver1 > ver2 and -1 if ver1 < ver2
local ver1="$1"
local ver2="$2"
local compare=
# convert version ending with '-rc<x>' to '-rc.<x>' where <x> is number
# as semantic versioning compares whole 'rc<x>' as alphanumeric identifier
# which results in rc2 > rc12. More information at https://semver.org/
ver1=$(sed -r "s/-rc([0-9]+)$/-rc.\1/" <<<"$1")
ver2=$(sed -r "s/-rc([0-9]+)$/-rc.\1/" <<<"$2")
ver1=$(sed -r "s/-rc([0-9]+)$/-rc.\1/" <<<"$ver1")
ver2=$(sed -r "s/-rc([0-9]+)$/-rc.\1/" <<<"$ver2")
# convert SeaBIOS versioning x.x.x.x to x.x.x-x so it can be used with semver
# checker. Also remove leading zeroes as it's not allowed in semver
@@ -736,19 +753,14 @@ compare_versions() {
if ! python3 -m semver check "$ver1" || ! python3 -m semver check "$ver2"; then
error_exit "Incorrect version format"
fi
compare=$(python3 -m semver compare "$ver1" "$ver2")
if [ "$compare" -eq -1 ]; then
return 1
else
return 0
fi
python3 -m semver compare "$ver1" "$ver2"
}
download_bios() {
if [ "${FETCH_LOCALLY}" = "false" ]; then
echo "Downloading Dasharo firmware..."
fi
if [ "${BIOS_LINK}" == "${BIOS_LINK_COMM}" ] || [ "${BIOS_LINK}" == "${BIOS_LINK_COMM_CAP}" ]; then
if [[ "${BIOS_LINK}" == "${FW_STORE_URL}"* ]]; then
fetch_fw "$BIOS_LINK" "$BIOS_UPDATE_FILE"
fetch_fw "$BIOS_HASH_LINK" "$BIOS_HASH_FILE"
fetch_fw "$BIOS_SIGN_LINK" "$BIOS_SIGN_FILE"
@@ -769,7 +781,7 @@ download_ec() {
if [ "${FETCH_LOCALLY}" = "false" ]; then
echo "Downloading Dasharo EC firmware..."
fi
if [ "${EC_LINK}" == "${EC_LINK_COMM}" ]; then
if [[ "${EC_LINK}" == "${FW_STORE_URL}"* ]]; then
fetch_fw "$EC_LINK" "$EC_UPDATE_FILE"
fetch_fw "$EC_HASH_LINK" "$EC_HASH_FILE"
fetch_fw "$EC_SIGN_LINK" "$EC_SIGN_FILE"
@@ -913,12 +925,11 @@ check_blobs_in_binary() {
}
check_if_me_disabled() {
ME_DISABLED=0
if [ $BOARD_HAS_ME_REGION -eq 0 ]; then
# No ME region
ME_DISABLED=1
ME_DISABLED=2
return
fi
@@ -929,7 +940,7 @@ check_if_me_disabled() {
return
elif [ $ME_OPMODE == "2" ]; then
echo "ME is disabled (HAP/Debug Mode)" >>$ERR_LOG_FILE
ME_DISABLED=1
ME_DISABLED=2
return
elif [ $ME_OPMODE == "3" ]; then
echo "ME is soft disabled (HECI)" >>$ERR_LOG_FILE
@@ -961,7 +972,7 @@ check_if_me_disabled() {
$CBMEM check_if_me_disabled_mock -1 |
grep "ME is disabled" &>/dev/null && ME_DISABLED=1 && return # HECI (soft) disabled
$CBMEM check_if_me_disabled_mock -1 |
grep "ME is HAP disabled" &>/dev/null && ME_DISABLED=1 && return # HAP disabled
grep "ME is HAP disabled" &>/dev/null && ME_DISABLED=2 && return # HAP disabled
# TODO: If proprietary BIOS, then also try to check SMBIOS for ME FWSTS
# BTW we could do the same in coreboot, expose FWSTS in SMBIOS before it
# gets disabled
@@ -1056,7 +1067,7 @@ set_intel_regions_update_params() {
if [ $BINARY_HAS_ME -ne 0 ]; then
if [ $BOARD_ME_REGION_RW -ne 0 ]; then
# ME writable and the binary provides ME, safe to flash if ME disabled
if [ $ME_DISABLED -eq 1 ]; then
if [ $ME_DISABLED -ne 0 ]; then
FLASHROM_ADD_OPT_REGIONS+=" -i me"
else
echo "The firmware binary to be flashed contains Management Engine (ME), but ME is not disabled!" >>$ERR_LOG_FILE
@@ -1375,6 +1386,7 @@ show_main_menu() {
fi
if check_if_dasharo; then
echo -e "${BLUE}**${YELLOW} ${TRANSITION_OPT})${BLUE} Transition Dasharo Firmware${NORMAL}"
echo -e "${BLUE}**${YELLOW} ${FUSE_OPT})${BLUE} Fuse platform${NORMAL}"
fi
}
@@ -1549,6 +1561,18 @@ main_menu_options() {
fi
read -p "Press Enter to continue."
return 0
;;
"${FUSE_OPT}")
check_if_dasharo || return 0
${CMD_DASHARO_DEPLOY} fuse
result=$?
if [ "$result" -ne $OK ] && [ "$result" -ne $CANCEL ]; then
send_dts_logs ask && return $OK
fi
read -p "Press Enter to continue."
return 0
;;
esac
@@ -1959,3 +1983,15 @@ fetch_fw() {
Please check your internet connection."
fi
}
reboot_countdown() {
sleep 0.5
_sleep_delay=5
echo "Rebooting in ${_sleep_delay} s:"
for ((i = _sleep_delay; i > 0; --i)); do
echo "${i}..."
sleep 1
done
echo "Rebooting"
sleep 0.5
}
scripts/dasharo-deploy.sh
+59 -37
View File
@@ -1023,20 +1023,7 @@ install_workflow() {
else
echo "The computer will reboot automatically in 5 seconds"
fi
sleep 0.5
echo "Rebooting in 5s:"
echo "5..."
sleep 1
echo "4..."
sleep 1
echo "3..."
sleep 1
echo "2..."
sleep 1
echo "1..."
sleep 0.5
echo "Rebooting"
sleep 1
reboot_countdown
if [ "$NEED_EC_RESET" == "true" ]; then
it5570_shutdown
else
@@ -1143,20 +1130,7 @@ update_workflow() {
sync
echo "Done."
echo "The computer will reboot automatically in 5 seconds"
sleep 0.5
echo "Rebooting in 5s:"
echo "5..."
sleep 1
echo "4..."
sleep 1
echo "3..."
sleep 1
echo "2..."
sleep 1
echo "1..."
sleep 0.5
echo "Rebooting"
sleep 1
reboot_countdown
${REBOOT}
}
@@ -1333,15 +1307,7 @@ transition_workflow() {
send_dts_logs
echo "The computer will reboot automatically in 5 seconds"
sleep 0.5
_sleep_delay=5
echo "Rebooting in ${_sleep_delay} s:"
for ((i = _sleep_delay; i > 0; --i)); do
echo "${i}..."
sleep 1
done
echo "Rebooting"
sleep 1
reboot_countdown
if [ "$NEED_EC_RESET" == "true" ]; then
it5570_shutdown
else
@@ -1463,6 +1429,45 @@ restore() {
done
}
fuse_workflow() {
if [[ -z "${EOM_LINK_COMM_CAP}" || -z "${DASHARO_REL_VER_CAP}" ]]; then
echo "No release with fusing support is available for your platform."
exit "${CANCEL}"
fi
BIOS_LINK="${EOM_LINK_COMM_CAP}"
BIOS_HASH_LINK="${EOM_HASH_LINK_COMM_CAP}"
BIOS_SIGN_LINK="${EOM_SIGN_LINK_COMM_CAP}"
UPDATE_VERSION="${DASHARO_REL_VER_CAP}"
check_intel_regions
check_if_me_disabled
if [ "${ME_DISABLED}" -ne 2 ]; then
# https://docs.dasharo.com/guides/capsule-update/#how-to-use-uefi-update-capsules
error_exit "Cannot fuse platform, ME has to be HAP disabled."
fi
if ! ask_for_confirmation "Fusing is irreversible. Are you sure you want to continue?"; then
exit "${CANCEL}"
fi
check_if_ac
download_bios
verify_artifacts bios
# Ask user for confirmation:
display_warning
if ! $CAP_UPD_TOOL "$BIOS_UPDATE_FILE" 2>>"$ERR_LOG_FILE"; then
error_exit Failed to queue capsule update!
fi
send_dts_logs
echo "The computer will reboot automatically in 5 seconds"
reboot_countdown
$REBOOT
}
usage() {
echo "Usage:"
echo " $0 install - Install Dasharo on this device"
@@ -1538,6 +1543,23 @@ restore)
transition)
transition_workflow
;;
fuse)
if check_if_fused &>>"$ERR_LOG_FILE"; then
echo "Platform is already fused, nothing to do"
exit "${CANCEL}"
fi
if [ -z "$DASHARO_SUPPORT_CAP_FROM" ]; then
echo "Platform doesn't support fusing."
exit "${CANCEL}"
fi
capsule_support_version="$(semver_version_compare "${DASHARO_VERSION}" "${DASHARO_SUPPORT_CAP_FROM}" 2>/dev/null)"
if [[ "${capsule_support_version}" == "0" || "${capsule_support_version}" == "1" ]]; then
# we support capsules: dasharo_version >= dasharo_support_cap_from
fuse_workflow
else
error_exit "Please update your Dasharo firmware first"
fi
;;
*)
usage
;;