Board:lenovo/x60/Installation: Difference between revisions

From coreboot
Jump to navigation Jump to search
(Link to a better guide)
 
(84 intermediate revisions by 7 users not shown)
Line 1: Line 1:
These Coreboot/Libreboot flashing instructions are designed for the [[Board:lenovo/x60|'''Lenovo X60''', '''X60s''', '''X60 tablet''',]] [[Board:lenovo/t60|'''T60''' and '''T60p''']].
These Coreboot/Libreboot flashing instructions are designed for the [[Board:lenovo/x60|'''Lenovo X60''', '''X60s''', '''X60 tablet''',]] [[Board:lenovo/t60|'''T60''' and '''T60p''']].


= Libreboot Flashing Procedure (Easy Method) =
{{Warning|The '''ThinkPad T60'''/T60p Series must be reconfigured to work with '''Libreboot'''. If you have an ATI GPU, ''you must replace it'' [http://libreboot.org/docs/hcl/index.html#t60_ati_intel with an Intel motherboard.] You will most likely need to swap the screen and/or swap the motherboard, in mast cases. [http://support.lenovo.com/us/en/docs/migr-62733 Follow the steps in the Lenovo HMM] to replace them.}}


: '''Note:''' ''Libreboot is not officially part of the coreboot project. Do not contact coreboot for support; instead, contact the libreboot community.''
{{Note|ThinkPad T60/T60p systems with an ATI GPU are compatible with '''Coreboot''' ''as long as proprietary VGABIOS blobs are extracted and installed. Other T60 laptops are also compatible, with the same configuration in coreboot.'' See [https://github.com/bibanon/Coreboot-ThinkPads/wiki/ThinkPad-T60p this guide] for more information.}}


The [http://libreboot.org/ Libreboot distribution] distributes pre-compiled ROM images along with scripts and instructions for easy flashing. Choose between these two guides:
=== Back up the original proprietary firmware ===


* [http://libreboot.org/docs/index.html Official Libreboot Documentation] - Official documentation created by the Libreboot developers themselves.
{{Warning|It is ''STRONGLY RECOMMENDED'' to create a backup of the vendor BIOS firmware; each vendor BIOS image has a unique, unrecoverable ID. Do not use another laptop's vendor BIOS image.}}
** '''Note:''' If you choose to follow the Official Libreboot Documentation, make sure to follow the Lenovo BIOS Backup procedure details below.
* [https://github.com/bibanon/Coreboot-ThinkPads/wiki BASLQC Libreboot ThinkPad Guides] - Vastly streamlined unofficial Libreboot installation guide. Organized in a more straightforward fashion, and has a few tips and tricks for specific devices.
** [https://github.com/bibanon/Coreboot-ThinkPads/wiki/ThinkPad-X60 ThinkPad X60 and X60 Tablet]
** [https://github.com/bibanon/Coreboot-ThinkPads/wiki/ThinkPad-T60 ThinkPad T60 (Intel GPU)]
** [https://github.com/bibanon/Coreboot-ThinkPads/wiki/Macbook-2-1 Macbook 2 1]
** [https://github.com/bibanon/Coreboot-ThinkPads/wiki/ThinkPad-T60p ThinkPad T60/T60p (ATI GPU)] - Requires proprietary VGABIOS.
 
=== Back up Official Lenovo BIOS (Libreboot) ===
 
It is ''STRONGLY RECOMMENDED'' to back up the vendor BIOS; each vendor BIOS image has a unique, unrecoverable ID. Do not use another laptop's vendor BIOS image.  
   
   
# Download, extract, and build the latest [http://www.libreboot.org/docs/release.html Libreboot binaries].
# Download and extract the latest [http://www.libreboot.org/download/ Libreboot binaries].
# From the <code>libreboot_bin/</code> folder, enter the <code>flashrom/</code> folder. 
# From the {{ic|libreboot_bin/}} or {{ic|libreboot_util/}} directory:
#: <code>cd flashrom</code>
# Run ''both'' of these commands to create a backup of the original firmware, creating a new file containing the data called {{ic|factory.bin}} (don't panic, nothing is being installed):  
# Run ''both'' of these commands to backup the BIOS to <code>factory.bin</code> (don't panic, nothing is being installed):  
#: {{ic|sudo ./flashrom/i686/flashrom_lenovobios_sst -p internal -r factory.bin}}
#: <code>sudo ./flashrom_lenovobios_sst -p internal -r factory.bin</code>
#: {{ic|sudo ./flashrom/i686/flashrom_lenovobios_macronix -p internal -r factory.bin}}
#: <code>sudo ./flashrom_lenovobios_macronix -p internal -r factory.bin -c "MX25L1605"</code>
# This will have created a file called "factory.bin", which is the contents of the flash chip while it had the original "BIOS" firmware. Back this up to a safe place (it can be useful for potential reverse engineering work, or for other testing).
# If a <code>factory.bin</code> file was created in the <code>flashrom/</code> folder, the Lenovo BIOS has been backed up successfully. If not, try the commands again. Copy this dump to a safe place.
# The source code for this version of flashrom can also be found on the libreboot website. It is a patched flashrom executable, to work around security restrictions in the original Lenovo BIOS (it will also be used for flashing, later on in this guide); the patches for it in libreboot can be found under resources/flashrom/patch/.
# Return to the <code>libreboot_bin/</code> folder. 
# There are two flash chips for the X60/T60. The instructions above simply used flashrom executables for both; one failed, and one should have succeeded. This is much easier than finding out what flash chip you have before hand (which involved elaborate hacks in flashrom, reading output, or taking apart the laptop and physically looking at the chip).
#: <code>cd ..</code>
 
* Source: [https://github.com/bibanon/Coreboot-ThinkPads/wiki/ThinkPad-X60#back-up-official-lenovo-bios BASLQC Libreboot ThinkPads - Backing up the Lenovo BIOS on the ThinkPad X60]
 
= Coreboot Flashing Procedure (Advanced) =
 
Below is a procedure that describes all the steps needed to flash Coreboot, in fine detail.
 
The Libreboot scripts have fully automated this complicated process, so these instructions have been expanded for educational purposes.
 
== Briefing ==
 
* '''Some SPI Flash chips require ''special flashrom patches''.'''
** Flash chips can be identified by various commands (REMS*, RDID etc.). Some of them reply with an ID for the vendor and the exact chip model; others just reply with a single byte.
** Unfortunately, the vendor BIOS forbids higher quality identification commands, so flashrom must be patched to use the lower quality opcodes.
** This type of patch will never be merged upstream, so it must be applied manually.
 
* '''The ''BUCTS register bit'' must be flipped before flashing Coreboot.'''
** [http://git.stuge.se/?p=bucts.git The bucts utility] can be used to flip the bit.
** This register bit doubles as a unique safety net that allows the vendor BIOS and Coreboot to coexist.
** Just unplug the CMOS battery to return to the vendor BIOS, in case Coreboot doesn't boot.
 
* '''The Coreboot ROM has to be specially patched to prevent it from overwriting the vendor BIOS.'''
** If the vendor BIOS gets overwritten, it would defeat the purpose of the BUCTS safety net.
** Just use this convenient little Bash one-liner to leave some free space at the beginning of the ROM.
*: <code>dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k; dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump; dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc</code>
 
* '''It is important to figure out''what type of flashchip'' is on the motherboard.'''.
** Early Coreboot developers had to disassemble the entire laptop just to take a peek at the flashchip. A magnifying glass is needed to read the tiny text burned on top of the chip.
** The Libreboot installation scripts have '''an ingenious new brute-force method''' of identifying the flashchip.
** First, build two patched flashrom binaries, one for SST and one for Macronix. Then try both of the binaries until you find one that works.
** Seems way too simple, but it's way better than ripping out the motherboard just to look at a chip.
 
== Flashrom Patch Definitions ==
 
: ''Source: [https://github.com/bibanon/Coreboot-ThinkPads/wiki/BIOS-Flashchip-Identification-Method#use-flashrom-to-identify-bios-chip-experimental BASQLC Libreboot ThinkPads - BIOS Flashchip Identification Method]''
 
Flashrom must be patched to use RES SPI identification and <code>spi_chip_write_1</code> for your flash chip, and to set the flash chip <code>model_id</code> to the RES opcode.
 
Below are the definitions that must be patched into <code>flashrom/flashchips.c</code> :
 
* '''SST25VF016B'''
** .probe - <code>probe_spi_res2</code>
** .model_id - <code>0x41</code>
** .write - <code>spi_chip_write_1</code>
* '''MX25l1605D'''
** .probe - <code>probe_spi_res1</code>
** .model_id - <code>0x14</code>
** .write - <code>spi_chip_write_1</code>
* '''Atmel ???''' (T60 Only?)
** Use -p internal:laptop=force_I_want_a_brick instead of -p internal, when running flashrom
** No patches necessary. You still need to do 2 flashing rounds, with the bucts/dd trick outlined in this guide.
 
These definitions were painstakingly discovered from excessively long and hardly informative flashchip documentation, mailing lists, and the output of flashrom. These definitions been confirmed to work after rigorous testing, [https://github.com/bibanon/Coreboot-ThinkPads/wiki/BIOS-Flashchip-Identification-Method#use-flashrom-to-identify-bios-chip-experimental See this wiki page for more information.]
 
* [http://paste.flashrom.org/view.php?id=1454 Flashrom Pastebin - Thinkpad R60 Flashrom Output] - Probing for SST SST25VF016B.RES2, 2048 kB: probe_spi_res2: id1 0xbf, id2 0x41
* [http://www.coreboot.org/pipermail/coreboot/2013-June/075962.html Coreboot Mailing List - Invalid OPCODE] - Allows us to infer that the model_id for <code>SST25VF016B</code> is 0xbf
* [http://coreboot.org/pipermail/coreboot/2013-June/076027.html Coreboot Mailing List - Bricked Lenovo T60]
* [http://macbook.donderklumpen.de/coreboot/ Donderclumpen - Coreboot on Macbook 2,1]] - Found <code>id1 0xbf, id2 0x2541</code> there, which corroborates with the inference from Peter Stuge.
* [http://ww1.microchip.com/downloads/en/DeviceDoc/S71271_04.pdf SST - SST25VF016B Official Datasheet]
 
== What You Need ==
 
* The [http://flashrom.org/Download#Installation_from_source flashrom source] (at least r1613 to make sure the laptops are whitelisted to work with flashrom)
* Flashrom patches for SST and Macronix flashchip support (provided in the next section).
* [http://git.stuge.se/?p=bucts.git The bucts utility].
* '''Dependencies''' (Debian/Ubuntu/Trisquel):
** '''Version Control''' - <code>sudo apt-get install subversion git</code>
** '''Build Essentials''' - <code>sudo apt-get -y install build-essential</code>
** '''flashrom''' - <code>sudo apt-get install libpci-dev pciutils zlib1g-dev libftdi-dev</code>
** '''Coreboot''' - <code>sudo apt-get install libncurses-dev iasl libc6-dev bison flex git</code>
** '''GRUB2''' (optional) - <code>sudo apt-get install bison libopts25 libselinux1-dev autogen m4 autoconf help2man libopts25-dev flex libfont-freetype-perl automake autotools-dev libfreetype6-dev texinfo ttf-unifont</code>
 
== Patch Flashrom ==
 
: ''Source: [https://github.com/bibanon/Coreboot-ThinkPads/wiki/BIOS-Flashchip-Identification-Method BASQLC Libreboot ThinkPads - Flashrom Patches]''
 
This method uses the ''brute force flashchip identification method'' used in the Libreboot flashing scripts. The idea is, if the patched flashrom can't identify the chip, it won't do anything; so why not try both patches?
 
''The most reliable method to identify the flashchip is to visually identify it; but flipping the motherboard requires complete disassembly.''
 
First, build both the SST and Macronix patches of Flashrom.


=== Step 1: Build Normal Flashrom ===
== Video BIOS (VGA option ROM) ==


# Obtain the latest <code>flashrom</code> source code with Subversion:
For those systems with Intel graphics, native graphics initialization code exists in coreboot. However, if you want to use the Intel (proprietary) Video BIOS, you should extract this from the factory.bin dump that you created earlier. If your system has ATI graphics (common on the T60), this is '''required'''.
#: <code>svn co svn://flashrom.org/flashrom/trunk flashrom</code>
# Build <code>flashrom</code> using the <code>make</code> command.
#: <code>make</code>
# Rename the <code>flashrom</code> binary to <code>flashrom_orig</code> .
#: <code>mv flashrom flashrom_orig</code>


=== Step 2: Build SST-patched Flashrom  ===
[http://www.coreboot.org/VGA_support#RECOMMENDED:_Extracting_from_your_vendor_bios_image VGA support] page on the coreboot wiki tells you how to extract it.


# Open the <code>flashchips.c</code> file in the <code>flashrom</code> source code folder.
Place this inside the coreboot/ directory, and in menuconfig enable it under '''Devices''' if you are using payloads other than SeaBIOS (for SeaBIOS, you should configure SeaBIOS to run it. Coreboot's default SeaBIOS configuration will use it). In either scenario, you will want to include it in the ROM image, so make sure to specify the path "vgabios.bin" (or whatever the path to your VBIOS image is) in menuconfig, making sure to enter the correct numbers for the PCI ID (get this using '''lspci -nn | grep VGA''').
# Use '''Ctrl-F''' to find the <code>SST25VF016B</code> entry.
# Modify the <code>.probe</code> , <code>.model_id</code> , and <code>.write</code> definitions with the following values.
#* .probe - <code>probe_spi_res1</code>
#* .model_id - <code>0xbf</code>
#* .write - <code>spi_chip_write_1</code>
# The result should look something like this:


<pre>{
=== Devices with ATI Mobility Radeon ===
        .vendor        = "SST",
        .name          = "SST25VF016B",
        .bustype        = BUS_SPI,
        .manufacture_id = SST_ID,
        .model_id      = 0x41,
        .total_size    = 2048,
        .page_size      = 256,
        .feature_bits  = FEATURE_WRSR_EITHER,
        .tested        = TEST_OK_PREW,
        .probe          = probe_spi_res2,
        /*
          unimportant code statements
          in between, leave them alone
        */
        .write          = spi_chip_write_1,
        .read          = spi_chip_read,
        .voltage        = {2700, 3600},
},</pre>


# Build <code>flashrom</code> using the <code>make</code> command.
You have to extract the ATI Option ROM from running system, as the vendor BIOS does patch the ATOMBIOS structure, but coreboot does not.
#: <code>make</code>
Vendor BIOS does:
# Rename the <code>flashrom</code> binary to <code>flashrom_lenovobios_sst</code> .
* Set IOBaseAddr offset
#: <code>mv flashrom flashrom_lenovobios_sst</code>
* Update connector list
* Update VRAM_UsageByFirmware
* Update MultimediaCapabilityInfo
* Update CompassionateData
* Update DAC_Info
* Update TDMS_Info


=== Step 3: Build Macronix-patched Flashrom  ===
You can use radeon_bios_decode to decode the ATOMBIOS structure.


# Use '''Ctrl-F''' to find the <code>SST25VF016B</code> entry.
== Installation instructions ==
# Modify the <code>.probe</code> , <code>.model_id</code> , and <code>.write</code> definitions with the following values.
#* .probe - <code>probe_spi_res1</code>
#* .model_id - <code>0x14</code>
#* .write - <code>spi_chip_write_1</code>
# The result should look something like this:


<pre>{
[https://gist.github.com/ArthurHeymans/c5ef494ada01af372735f237f6c6adbe This guide] provides up to date instructions on how to build and flash coreboot on a thinkpad x60.
        .vendor        = "Macronix",
        .name          = "MX25L1605D/MX25L1608D/MX25L1673E",
        .bustype        = BUS_SPI,
        .manufacture_id = MACRONIX_ID,
        .model_id      = 0x14,
        .total_size    = 2048,
        .page_size      = 256,
        .feature_bits  = FEATURE_WRSR_WREN,
        .tested        = TEST_OK_PREW,
        .probe          = probe_spi_res1,
        /*
          unimportant code statements
          in between, leave them alone
        */
        .write          = spi_chip_write_1,
        .read          = spi_chip_read, /* Fast read (0x0B), dual I/O supported */
        .voltage        = {2700, 3600},
},</pre>


# Build <code>flashrom</code> using the <code>make</code> command.
== Patch the coreboot ROM image for bucts (OLD) ==
#: <code>make</code>
# Rename the <code>flashrom</code> binary to <code>flashrom_lenovobios_macronix</code> .
#: <code>mv flashrom flashrom_lenovobios_macronix</code>


=== Step 4: Rename the Vanilla Flashrom Binary ===
Failure to follow this will result in a bricked laptop.


We renamed the untouched flashrom binary to <code>flashrom_orig</code>, so that it wouldn't be overwritten. Now we need to restore the original name.
=== BUC.TS ===


# Rename the <code>flashrom_orig</code> binary to <code>flashrom</code> .
'''B'''ack'''u'''p '''C'''ontrol '''T'''op '''S'''wap.
#: <code>mv flashrom_orig flashrom</code>


== Back up Official Lenovo BIOS ==
# Run the {{ic|dd}} command below to shift the first 64K of data from <code>coreboot.rom</code>
#: {{ic|<nowiki>dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k</nowiki>}}
# Run the dd command below to display the first 64k of {{ic|coreboot.rom}}
#: {{ic|<nowiki>dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump</nowiki>}}
# Verify that the complete range is filled with {{ic|ff}} bytes before proceeding.
#: The output of the {{ic|dd}} command above must EXACTLY match the text below. If not, the coreboot image needs to be rebuilt with the second-to-last 64kbyte block unused.
#:: {{ic|0000000 ffff ffff ffff ffff ffff ffff ffff ffff *0010000}}
# Run the {{ic|dd}} command below:
#: {{ic|<nowiki>dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s
coreboot.rom) - 0x20000] count=64k conv=notrunc</nowiki>}}


It is ''STRONGLY RECOMMENDED'' to back up the vendor BIOS; each vendor BIOS image has a unique, unrecoverable ID. Do not use another laptop's vendor BIOS image.
What this did was copy the upper 64KiB section of the ROM image, into the section below. This is the boot block; lenovobios prevents writing to the upper 64KiB block (by default, it prevents all other regions but a patched flashrom binary can flash those regions in software). A utility called '''bucts''' will be used later on to set the system up so that it boots from the before-final 64KiB block during the initial installation of coreboot.
   
   
# Enter the <code>flashrom/</code> folder. 
* Source: [http://comments.gmane.org/gmane.linux.bios/69354 gmane.linux.bios Mailing List - LinuxBIOS on T60] - Peter Stuge's Method of installing Coreboot on the X60.
#: <code>cd flashrom</code>
# Run ''both'' of these commands to backup the BIOS to <code>factory.bin</code> (don't panic, nothing is being installed):
#: <code>sudo ./flashrom_lenovobios_sst -p internal -r factory.bin</code>
#: <code>sudo ./flashrom_lenovobios_macronix -p internal -r factory.bin  -c "MX25L1605"</code>
# If a <code>factory.bin</code> file was created in the <code>flashrom/</code> folder, the Lenovo BIOS has been backed up successfully. If not, try the commands again. Copy this dump to a safe place.
# Return to the <code>libreboot_bin/</code> folder. 
#: <code>cd ..</code>
 
* Source: [https://github.com/bibanon/Coreboot-ThinkPads/wiki/ThinkPad-X60#back-up-official-lenovo-bios BASLQC Libreboot ThinkPads - Backing up the Lenovo BIOS on the ThinkPad X60]
 
== Build the Coreboot ROM ==
 
* See [http://www.coreboot.org/Build_HOWTO Build HOWTO] for how to build ROM images in coreboot.
** ''(optional)'' If you need to obtain and embed the VGABIOS in Coreboot (e.g. T60 with ATI GPU, text in SeaBIOS), [https://github.com/bibanon/Coreboot-ThinkPads/wiki/T60p-Extract-VGABIOS follow this procedure.]
** [https://github.com/bibanon/Coreboot-ThinkPads/wiki/T60p-Build-Coreboot Here is a clearer guide] which shows exactly how to build Coreboot, set up the <code>.config</code> file, and embed the VGABIOS.
 
== Patch Coreboot ROM ==
 
The BUCTS switch provides a safety net in case Coreboot does not run the first time; just unplug the CMOS battery to return to the vendor BIOS.
 
This patch prevents the Coreboot ROM from overwriting the vendor BIOS (which would destroy the safety net). ''Choose one method:''
 
=== Method 1: One-line Patcher===
 
# Place the <code>coreboot.rom</code> file in the current folder.
# Run this one-liner to patch the ROM in one command:
#: <code>dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k; dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump; dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc</code>


=== Method 2: Verbose Method ===
== Install Coreboot (First Flash) (OLD) ==


# Copy the built <code>coreboot.rom</code> to the <code>flashrom</code> source code folder.
The initial flash will write coreboot to the flash chip, but with the final 64KiB boot block from lenovobios (which is write-protected) intact. bucts will be used to make the system boot from the lower 64KiB boot block (before the final one) where you previously copied it to using dd.
# Run the <code>dd</code> command below to shift the first 64K of data from <code>coreboot.rom</code>
#: <code>dd if=coreboot.rom of=top64k.bin bs=1 skip=[(stat -c %s coreboot.rom) - 0x10000] count=64k</code>
# Run the dd command below to display the first 64k of <code>coreboot.rom</code>
#: <code>dd if=coreboot.rom bs=1 skip=[(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump</code>
# Verify that the complete range is filled with <code>ff</code> bytes before proceeding.
#: The output of the <code>dd</code> command above must EXACTLY match the text below. If not, the coreboot image needs to be rebuilt with the second-to-last 64kbyte block unused.
#:: <code>0000000 ffff ffff ffff ffff ffff ffff ffff ffff *0010000</code>
# Run the <code>dd</code> command below:
#: <code>dd if=top64k.bin of=coreboot.rom bs=1 seek=[(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc</code>
* Source: [http://comments.gmane.org/gmane.linux.bios/69354 gmane.linux.bios Mailing List - LinuxBIOS on T60] - Peter Stuge's Method of installing Coreboot on the X60.


== Install Coreboot (First Flash) ==
As before, you will be using the patched version of flashrom distributed in libreboot. The binary releases of libreboot come with both bucts and flashrom already compiled (you can also build them from source, if you like). You can also get bucts and flashrom from upstream (optional):
* http://git.stuge.se/?p=bucts.git
* http://flashrom.org/ - apply the lenovobios patches from libreboot src - resources/flashrom/patch/lenovobios_* - there are 2 patches, for different chips. Build 2 executables, each with one of the patches (but not the other)


First, install Coreboot alongside the vendor BIOS.
The libreboot project also distributes ROM images already compiled for the X60/T60 (dd modification for bucts already applied on all ROM images), if you prefer (for T60, please avoid these if you have either a 1024x768 screen and/or ATI graphics; also, the 15.4" widescreen T60 laptops are untested in libreboot):


# Copy the <code>coreboot.rom</code> to the <code>flashrom/</code> folder.
# Run {{ic|su}}  to become root.
# Run <code>su</code> to become root.
# You '''must''' run bucts, flipping the register so that the value is high (1) (as explained before):
# Run <code>bucts 1</code>
# Run {{ic|./bucts/i686/bucts 1}}
## It should have said '''Updated BUC.TS=1''' for the above command. If not, please do NOT continue; get help.
# Flash Coreboot (run both of these commands, whichever works first):
# Flash Coreboot (run both of these commands, whichever works first):
#: <code>sudo ./flashrom_lenovobios_sst -p internal -w coreboot.rom</code>
#: {{ic|sudo ./flashrom/i686/flashrom_lenovobios_sst -p internal -w coreboot.rom}} 
#: <code>sudo ./flashrom_lenovobios_macronix -p internal -w coreboot.rom</code>
#: {{ic|sudo ./flashrom/i686/flashrom_lenovobios_macronix -p internal -w coreboot.rom}}
#* This will take a while, and will spit out a few errors (since half the flashchip is write protected).  
#* This will take a while, and will spit out a few errors (since the upper 64KiB region of the flash is write-protected).  
# Check to make sure that the errors match the following:
# You'll see a lot of error output, but relax: this is normal. It will look something like this:


    <code>Reading old flash chip contents... done.
{{bc|    Reading old flash chip contents... done.
     Erasing and writing flash chip... spi_block_erase_20 failed during command execution at address 0x0
     Erasing and writing flash chip... spi_block_erase_20 failed during command execution at address 0x0
     Reading current flash chip contents... done. Looking for another erase function.
     Reading current flash chip contents... done. Looking for another erase function.
Line 271: Line 102:
     FAILED!
     FAILED!
     Uh oh. Erase/write failed. Checking if anything has changed.
     Uh oh. Erase/write failed. Checking if anything has changed.
     Reading current flash chip contents... until done.
     Reading current flash chip contents... done.
     Apparently at least some data has changed.
     Apparently at least some data has changed.
     Your flash chip is in an unknown state.</code>
     Your flash chip is in an unknown state.}}


# If the errors are an exact match, the flash was successful.
# If the errors are like that then, contrary to the error output, the image was flashed successfully.
#* If they don't match, '''DO NOT TURN OFF YOUR LAPTOP'''. Flash again.
#* If they don't match, '''DO NOT TURN OFF YOUR LAPTOP'''; get help instead.
# Power cycle the machine (i.e. a cold boot, not just a reboot). Your laptop will reboot into Coreboot.
# Shut down the laptop (fully shut it down, as in, turn it off), and then boot it again in a few seconds. Your laptop will boot into Coreboot.
#* '''Note:''' SeaBIOS will not display anything without a proprietary VGABIOS blob. However, Linux should work fine after booting.
 
{{Note|SeaBIOS will not display anything without a proprietary VGABIOS blob (Intel or ATI GPU) or (Intel GPU only) the free SeaVGABIOS ("coreboot linear framebuffer" in SeaBIOS menuconfig) option ROM in SeaBIOS combined with native graphics initialization, but GNU/Linux should work fine in any case.}}


* Sources: [http://www.flashrom.org/pipermail/flashrom/2012-April/009124.html Peter's mail] - [http://thread.gmane.org/gmane.linux.bios/69354 Mailing List Thread 1] - [http://thread.gmane.org/gmane.linux.bios.flashrom/575 Mailing List Thread 2]
* Sources: [http://www.flashrom.org/pipermail/flashrom/2012-April/009124.html Peter's mail] - [http://thread.gmane.org/gmane.linux.bios/69354 Mailing List Thread 1] - [http://thread.gmane.org/gmane.linux.bios.flashrom/575 Mailing List Thread 2]


=== Recover from Failed Flash with Bucts ===
== Install Coreboot (Second Flash) (OLD) ==
 
: '''Note:''' ''If you forgot to set <code>bucts 1</code>, or forgot to patch the Coreboot ROM; your laptop has been bricked, and requires hardware flashing for recovery.''
 
bucts sets a register that lives on the RTC well, ie. it is powered by the same source that keeps the clock alive. Usually that's a CMOS battery on the mainboard.
 
# Unscrew the keyboard (check Lenovo Hardware Maintenence Manual for more info).
# Remove the keyboard.
# Unplug the CMOS battery (it's a yellow circle).
# Wait a few seconds, and plug it back in.
# Reassemble the ThinkPad.
# Turn the ThinkPad back on.
#* On the ThinkPad x60 series, bucts issues might also be solved by "discarging RTC", which is done by pressing the power button 5 times for 10 seconds.
 
Afterwards, the register should be reset and the system should boot into the vendor BIOS.
 
== Install Coreboot (Second Flash) ==


Next, flash Coreboot a second time to overwrite the vendor BIOS.
Next, flash Coreboot a second time to overwrite the original boot block. This time, you can (and should) used an unpatched version of flashrom. Libreboot also comes with this, or (once again) you can also use upstream if you like.


# Run <code>su</code> to become root.
# Run {{ic|su}}  to become root, and change to the libreboot_bin or libreboot_util directory.
# Enter the <code>flashrom</code> folder.
## Run {{ic|./flashrom/i686/flashrom -p internal -w coreboot.rom}}
# Run <code>./flashrom -p internal -w coreboot.rom</code>
## It should say '''Verifying flash... VERIFIED''' at the end of the output. If not, get help.
#: This will successfully overwrite the entire flash chip with no errors, including the last 64k that were write protected with the factory BIOS.
# Reset bucts back to normal (only if the step above worked):
#: If it complains about 3 different flashchips (in the case of macronix chip), do this instead:
## Run {{ic|bucts 0}}
#: Run <code>./flashrom -p internal -w coreboot.rom -c "MX25L1605D/MX25L1608D/MX25L1673E"</code>
# Run <code>bucts 0</code>
# Reboot the laptop. Coreboot has been successfully installed.
# Reboot the laptop. Coreboot has been successfully installed.


== Recovery with a Hardware Firmware Flasher ==
== Recovery with a Hardware Firmware Flasher ==
If you had a bad flash you will need to use a hardware flasher to reflash the BIOS.
If you had a bad flash you will need to use a hardware flasher to reflash the BIOS.


The BASLQC provides a more comprehensive guide to hardware BIOS flashing below, with research on a Raspberry Pi-based hardware flasher: (Not a Coreboot project)
If you want something that's easy to follow, the libreboot project shows how to flash externally using a BeagleBone Black
* [https://github.com/bibanon/Coreboot-ThinkPads/wiki/X60-T60-Hardware-Flashing BASLQC Libreboot ThinkPads - BIOS Hardware Flashing]
* [http://libreboot.org/docs/install/x60_unbrick.html Unbricking the X60]
* [http://libreboot.org/docs/install/x60tablet_unbrick.html Unbricking the X60 Tablet]
* [http://libreboot.org/docs/install/t60_unbrick.html Unbricking the T60]
* [http://libreboot.org/docs/install/bbb_setup.html How to flash using the BBB]


The libreboot project also has picture guides showing disassembly and external flashing instructions ('''these 3 links are to the libreboot project. Contact libreboot, *not* coreboot, for support'''):
== Coreboot standard configuration ==
* [http://libreboot.org/docs/howtos/x60_unbrick.html X60/X60s unbricking guide]
* It's now the default that when running SeaBios, that it (instead of coreboot) runs the VGA option rom.
* [http://libreboot.org/docs/howtos/x60tablet_unbrick.html X60 Tablet unbricking guide]
See [[VGA_support]] for details on how to include the VGA BIOS image.
* [http://libreboot.org/docs/howtos/t60_unbrick.html T60 unbricking guide]


The libreboot guides linked above are based on the information below from the coreboot project:
== Recently tested revisions on the X60 ==


=== Required/advised hardware and informations ===
See [http://review.coreboot.org/gitweb?p=board-status.git;a=tree;f=lenovo/x60;hb=HEAD the most recent board-status submissions]
* [http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42x3550_04.pdf X60 Hardware Maintenance Manual] or [http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42t7844_04.pdf T60 Hardware Maintenance Manual] for disassembling the laptop
* An SO-8 IC clip, like the [http://www.tme.eu/en/details/pom-5250/test-clips/pomona/5250/ Pomona 5250] for instance.
* An external flashrom programmer


=== Disassembling the ThinkPad ===
[[Supported_Motherboards#2014W08 | 970ad7076388b3ef98988121170df86196d493b4 coreboot-4.0-5534-g970ad70 ]]


Follow the [http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42x3550_04.pdf X60 Hardware Maintenance Manual] or [http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42t7844_04.pdf T60 Hardware Maintenance Manual] to disassemble the laptop, until you can access the BIOS chip.
[[Supported_Motherboards#2013W50 | 8496c4dbec41b3a9284fc29b0dcd97fc8946223b coreboot-4.0-5045-g9bf05de  ]]


(photos needed)
== Recently tested revisions on the T60 ==


* On the X60, the BIOS chip is on the bottom of the motherboard, under a layer of protective black tape.
See [http://review.coreboot.org/gitweb?p=board-status.git;a=tree;f=lenovo/t60;hb=HEAD the most recent board-status submisssions]
* On the T60, the BIOS chip is just under the palmrest, but blocked by a magnesium frame (which you will have to remove).


=== Bus Pirate + SOIC Clip Configuration ===
[[Supported_Motherboards#2014W10 | a172ea546992c3f6f6a99b4dbaabbdae4c959707 4.0-5611-ga172ea5 ]]
Below is a diagram of how to plug the Bus Pirate into the SOIC Clip, with colors based on [dangerousprototypes.com/docs/Common_Bus_Pirate_cable_pinouts the Seeed Studio pinout.] Your cable colors may differ (such as the Sparkfun layout).


<pre>8765
[[Supported_Motherboards#2013W50 | 9bf05de5ab2842fc83cea8da5e9058417fc4bc24 4.0-5045-g9bf05de ]]
----
|   |
----
1234</pre>


# CS (white)
== Status ==
# MISO (black)
* [[Board:lenovo/x60|Thinkpad X60 Status]]
# ''not used''
* [[Board:lenovo/t60|Thinkpad T60 Status]]
# GND (brown)
# MOSI (gray)
# CLK (purple)
# ''not used''
# 3.3V (red) - Depends on chip
Make sure the pinouts are correct; otherwise, Bus Pirate will fail to detect a chip, or it will "detect" an <code>0x0</code> chip.


Finally, make sure that the Pomona clip makes contact with the metal wires of the chip. It can be a challenge, but keep trying.
= OLD INFO =


=== How to supply power to the flashchip ===
The status and installation pages used to be one in the same.
There are two ways to supply power to the chip: plugging in an AC adapter (without turning it on), and using the 8th 3.3v pin.
I have found that the SST chips work best with the 8th pin, while the Macronix chips require an AC Adapter to power up.


Your results may vary.
This page underwent massive changes, some of which weren't good. Below is a copy of what used to be on the old page:


== Reading the Flashchip with Bus Pirate ==
== Flashing on the laptop instructions. ==
'''Lenovo X60''', '''X60s''', '''T60''' and '''T60p''' flashing instructions.
# Visually inspect (with a magnifying glass) the type of flashchip on the motherboard.
# Clip the Pomona SOIC-8 Clip onto the flashchip. Make sure that the Bus Pirate is connected to it as shown above.
# download and extract the Libreboot binaries, and enter the <code>libreboot_bin/flashrom</code> folder.


<code>cd libreboot_bincd flashrom</code>
These Lenovo laptops have a register that must be flipped before coreboot can be flashed.
If it is an SST, run this command:


  <code>sudo ./flashrom_lenovobios_sst -p buspirate_spi:dev=/dev/ttyUSB0 -r test.rom</code>
For those/some models with SPI flash chips you have also to modify flashrom. Because the chipset locks down the available commands that flashrom can send to the flash chip, you also need to change the flashrom source in a way that is not suitable to upstream. Flash chips can be identified by various commands (REMS*, RDID etc.). Some of them reply with an ID for the vendor and the exact chip model; others just reply with a single byte which is fine if there is only a small number of chips to distinguish, but won't work for the huge number of flash chips known to flashrom. The problem with the vendor BIOS is that it forbids the higher quality identification commands, so you need to force flashrom to use the lower quality opcode for the chip in your Thinkpad. You have to know the chip model beforehand (e.g. by inspection). Known models on the x60s are SST25VF016B, MX25L1605D and maybe others.
If it is a Macronix, run this command:


<code>sudo ./flashrom_lenovobios_macronix -c "MX25L1605"; -p buspirate_spi:dev=/dev/ttyUSB0 -r test.rom</code>
You will need: the [http://flashrom.org/Download#Installation_from_source flashrom source] (at least r1613 to make sure the laptops are whitelisted to work with flashrom), a small modification of it (as explained below in detail), and [http://git.stuge.se/?p=bucts.git the bucts utility].
Next, check the md5sum of the dump:


<code>md5sum test.rom</code>  
# Patch flashrom to use RES SPI identification and spi_chip_write_1 for your flash chip, as well as change the flash chip model id to fit the RES opcode.
Run the <code>flashrom</code> command again to make a second dump. Then, check the md5sum of the second dump:
#* Find the definition of your flash chip in flashrom's flashchips.c
#** Optionally, you can copy the existing definition as it is done in [http://patchwork.coreboot.org/patch/3621/ this patch]. This will allow to switch between the two definitions with the -c parameter. Be sure to change the <code>.name</code> field in that case (e.g. <code>.name = "SST25VF016B-RES",</code>).
#* Change the .probe field to probe_spi_resN where N equals the number of ID bytes the flash replies to the RES ID command (e.g. <code>.probe = probe_spi_res2,</code> if the chip replies with one byte vendor ID and one byte model ID)
#* Change the .model_id field to the RES model ID given in the datasheet of the flash chip (e.g. <code>.model_id = 0x14,</code>)
#* Change the .write field to spi_chip_write_1 (i.e. <code>.write = spi_chip_write_1,</code>)
# Run <code>flashrom -p internal -r factory.bin</code>
#: This step is IMPORTANT since the factory BIOS in your machine is tied to your particular system board (or "planar" in IBM FRU terms) with a unique ID not present in factory BIOS updates.
# Run <code>dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k</code>
# Run <code>dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump</code>
#: Verify that the complete range is filled with ff bytes before proceeding! The above command must output:
#: <code>0000000 ffff ffff ffff ffff ffff ffff ffff ffff</code>
#: <code>*</code>
#: <code>0010000</code>
#: If this is not the case, the coreboot image needs to be rebuilt with the second-to-last 64kbyte block unused.
# Run <code>dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc</code>
# Run <code>bucts 1</code>
# Run <code>flashrom -p internal -w coreboot.rom</code>
#: This will be slow, it will output errors for addresses 0x0 and 0x1f0000 when working with a 2 Mbyte flash chip, and it will say "FAILED!" at the end, see [http://www.flashrom.org/pipermail/flashrom/2012-April/009124.html Peter's mail] before you panic.
# Power cycle the machine (i.e. a cold boot, not just a reboot), now starting with coreboot
# Revert all changes made to flashrom (maybe backup the binary for later experiments)
# Run <code>flashrom -p internal -w coreboot.rom</code>.
#: This will successfully overwrite the entire flash chip, including the last 64k that were write protected with the factory BIOS.
# Run <code>bucts 0</code>


<code>md5sum test.rom</code>
If the md5sums match after three tries, <code>flashrom</code> has managed to read the flashchip precisely (but not always accurately). You may try and flash Libreboot now.


== Flashing Libreboot with Bus Pirate ==
<blockquote>
'''Note:''' replace <code>/path/to/libreboot.rom</code> with the location of your chosen ROM, such as <code>../bin/x60/libreboot_usqwerty.rom</code>):


</blockquote>
See also http://thread.gmane.org/gmane.linux.bios/69354 http://thread.gmane.org/gmane.linux.bios.flashrom/575
If your chip is SST, run this command:


<code>sudo ./flashrom_lenovobios_sst -p buspirate_spi:dev=/dev/ttyUSB0 -w /path/to/libreboot.rom</code>
== Recovery ==
If your chip is Macronix, run this command:
If you had a bad flash you will need a recovery method.


<code>sudo ./flashrom_lenovobios_macronix -c "MX25L1605" -p buspirate_spi:dev=/dev/ttyUSB0 -w /path/to/libreboot.rom</code>
If you only set bucts, then rebooted without doing any flash writes, things might be easier:
Once that command outputs the following, the flash has completed successfully. If not, just flash again.
bucts sets a register that lives on the RTC well, ie. it is powered by the same source that keeps the clock alive. Usually that's a battery on the mainboard, and often there's some way to cut the source (by removing the battery, a jumper, or pads that can be shorted).
After doing that (for a few seconds, there might be some capacitors in the way that keep power stable), the register should be reset and the system should boot as normal.


<code>Reading old flash chip contents... done.Erasing and writing flash chip... Erase/write done.Verifying flash... VERIFIED.</code>
On the x60x, bucts issues might also be solved by "discarging RTC", which is done by pressing the power button 5 times for 10 seconds.
=== Required/advised hardware and informations ===
* [http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42x3550_04.pdf X60 Hardware Maintenance Manual] or [http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42t7844_04.pdf T60 Hardware Maintenance Manual] for disassembling the laptop
* An SO-8 IC clip, like the [http://www.tme.eu/en/details/pom-5250/test-clips/pomona/5250/ Pomona 5250] for instance.
* An external flashrom programmer


=== Howto (old) ===
=== Howto ===
0.  wire the pomona clip to a programmer that way:
0.  wire the pomona clip to a programmer that way:


Line 431: Line 242:
# flash coreboot or the BIOS
# flash coreboot or the BIOS
# remount the laptop
# remount the laptop
See also [http://flashrom.org/ISP In-System Programming]


== Coreboot standard configuration ==
== Coreboot standard configuration ==
* It's now the default that when running SeaBios, that it (instead of coreboot) runs the VGA option rom.
* It's advised to make SeaBios(instead of coreboot) run the VGA option rom by disabling CONFIG_VGA_ROM_RUN:
[ ] Run VGA Option ROMs
in make menuconfig.
Note that you still need to include the option rom in coreboot:
[*] Add a VGA BIOS image
See [[VGA_support]] for details on how to include the VGA BIOS image.
See [[VGA_support]] for details on how to include the VGA BIOS image.
* Also disable CONFIG_S3_VGA_ROM_RUN which is for really old linux kernels(2.4) (which is disabled automatically if you don't select CONFIG_VGA_ROM_RUN).


== VBIOS replacement (native graphics) ==
From the #coreboot IRC Channel on FreeNode servers:
The VGA option ROM (see above) is proprietary. Under devices in menuconfig, disable loading option ROM,s and enable 'Native graphics initialization'. '''Use the GRUB payload'''.
Oct 04 13:47:09 <patrickg>      that's about running vga init on s3 wakeup - required for some older linux kernels
 
[...]
TODO: add notes here for how to patch coreboot for T60 native graphics (it's in libreboot already, or on 5345 on coreboot gerrit).
  Oct 04 13:47:25 <patrickg>      BIOSes call it "POST on wakeup" or sth like that
 
Oct 04 13:47:30 <patrickg>      older ~ 2.4 class ;)
== Recently tested revisions on the X60 ==
 
See [http://review.coreboot.org/gitweb?p=board-status.git;a=tree;f=lenovo/x60;hb=HEAD the most recent board-status submissions]
 
[[Supported_Motherboards#2014W08 | 970ad7076388b3ef98988121170df86196d493b4 coreboot-4.0-5534-g970ad70 ]]
 
[[Supported_Motherboards#2013W50 | 8496c4dbec41b3a9284fc29b0dcd97fc8946223b coreboot-4.0-5045-g9bf05de ]]
 
== Recently tested revisions on the T60 ==
 
See [http://review.coreboot.org/gitweb?p=board-status.git;a=tree;f=lenovo/t60;hb=HEAD the most recent board-status submisssions]
 
[[Supported_Motherboards#2014W10 | a172ea546992c3f6f6a99b4dbaabbdae4c959707 4.0-5611-ga172ea5 ]]
 
[[Supported_Motherboards#2013W50 | 9bf05de5ab2842fc83cea8da5e9058417fc4bc24 4.0-5045-g9bf05de ]]


== Status ==
== Status ==
* [[Board:lenovo/x60|Thinkpad X60 Status]]
* [[Thinkpad_X60s|Thinkpad X60s Status]]
* [[Board:lenovo/t60|Thinkpad T60 Status]]

Latest revision as of 15:52, 29 May 2018

These Coreboot/Libreboot flashing instructions are designed for the Lenovo X60, X60s, X60 tablet, T60 and T60p.

Warning: The ThinkPad T60/T60p Series must be reconfigured to work with Libreboot. If you have an ATI GPU, you must replace it with an Intel motherboard. You will most likely need to swap the screen and/or swap the motherboard, in mast cases. Follow the steps in the Lenovo HMM to replace them.
Note: ThinkPad T60/T60p systems with an ATI GPU are compatible with Coreboot as long as proprietary VGABIOS blobs are extracted and installed. Other T60 laptops are also compatible, with the same configuration in coreboot. See this guide for more information.

Back up the original proprietary firmware

Warning: It is STRONGLY RECOMMENDED to create a backup of the vendor BIOS firmware; each vendor BIOS image has a unique, unrecoverable ID. Do not use another laptop's vendor BIOS image.
  1. Download and extract the latest Libreboot binaries.
  2. From the libreboot_bin/ or libreboot_util/ directory:
  3. Run both of these commands to create a backup of the original firmware, creating a new file containing the data called factory.bin (don't panic, nothing is being installed):
    sudo ./flashrom/i686/flashrom_lenovobios_sst -p internal -r factory.bin
    sudo ./flashrom/i686/flashrom_lenovobios_macronix -p internal -r factory.bin
  4. This will have created a file called "factory.bin", which is the contents of the flash chip while it had the original "BIOS" firmware. Back this up to a safe place (it can be useful for potential reverse engineering work, or for other testing).
  5. The source code for this version of flashrom can also be found on the libreboot website. It is a patched flashrom executable, to work around security restrictions in the original Lenovo BIOS (it will also be used for flashing, later on in this guide); the patches for it in libreboot can be found under resources/flashrom/patch/.
  6. There are two flash chips for the X60/T60. The instructions above simply used flashrom executables for both; one failed, and one should have succeeded. This is much easier than finding out what flash chip you have before hand (which involved elaborate hacks in flashrom, reading output, or taking apart the laptop and physically looking at the chip).

Video BIOS (VGA option ROM)

For those systems with Intel graphics, native graphics initialization code exists in coreboot. However, if you want to use the Intel (proprietary) Video BIOS, you should extract this from the factory.bin dump that you created earlier. If your system has ATI graphics (common on the T60), this is required.

VGA support page on the coreboot wiki tells you how to extract it.

Place this inside the coreboot/ directory, and in menuconfig enable it under Devices if you are using payloads other than SeaBIOS (for SeaBIOS, you should configure SeaBIOS to run it. Coreboot's default SeaBIOS configuration will use it). In either scenario, you will want to include it in the ROM image, so make sure to specify the path "vgabios.bin" (or whatever the path to your VBIOS image is) in menuconfig, making sure to enter the correct numbers for the PCI ID (get this using lspci -nn | grep VGA).

Devices with ATI Mobility Radeon

You have to extract the ATI Option ROM from running system, as the vendor BIOS does patch the ATOMBIOS structure, but coreboot does not. Vendor BIOS does:

  • Set IOBaseAddr offset
  • Update connector list
  • Update VRAM_UsageByFirmware
  • Update MultimediaCapabilityInfo
  • Update CompassionateData
  • Update DAC_Info
  • Update TDMS_Info

You can use radeon_bios_decode to decode the ATOMBIOS structure.

Installation instructions

This guide provides up to date instructions on how to build and flash coreboot on a thinkpad x60.

Patch the coreboot ROM image for bucts (OLD)

Failure to follow this will result in a bricked laptop.

BUC.TS

Backup Control Top Swap.

  1. Run the dd command below to shift the first 64K of data from coreboot.rom
    dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k
  2. Run the dd command below to display the first 64k of coreboot.rom
    dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump
  3. Verify that the complete range is filled with ff bytes before proceeding.
    The output of the dd command above must EXACTLY match the text below. If not, the coreboot image needs to be rebuilt with the second-to-last 64kbyte block unused.
    0000000 ffff ffff ffff ffff ffff ffff ffff ffff *0010000
  4. Run the dd command below:
    dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc

What this did was copy the upper 64KiB section of the ROM image, into the section below. This is the boot block; lenovobios prevents writing to the upper 64KiB block (by default, it prevents all other regions but a patched flashrom binary can flash those regions in software). A utility called bucts will be used later on to set the system up so that it boots from the before-final 64KiB block during the initial installation of coreboot.

Install Coreboot (First Flash) (OLD)

The initial flash will write coreboot to the flash chip, but with the final 64KiB boot block from lenovobios (which is write-protected) intact. bucts will be used to make the system boot from the lower 64KiB boot block (before the final one) where you previously copied it to using dd.

As before, you will be using the patched version of flashrom distributed in libreboot. The binary releases of libreboot come with both bucts and flashrom already compiled (you can also build them from source, if you like). You can also get bucts and flashrom from upstream (optional):

The libreboot project also distributes ROM images already compiled for the X60/T60 (dd modification for bucts already applied on all ROM images), if you prefer (for T60, please avoid these if you have either a 1024x768 screen and/or ATI graphics; also, the 15.4" widescreen T60 laptops are untested in libreboot):

  1. Run su to become root.
  2. You must run bucts, flipping the register so that the value is high (1) (as explained before):
  3. Run ./bucts/i686/bucts 1
    1. It should have said Updated BUC.TS=1 for the above command. If not, please do NOT continue; get help.
  4. Flash Coreboot (run both of these commands, whichever works first):
    sudo ./flashrom/i686/flashrom_lenovobios_sst -p internal -w coreboot.rom
    sudo ./flashrom/i686/flashrom_lenovobios_macronix -p internal -w coreboot.rom
    • This will take a while, and will spit out a few errors (since the upper 64KiB region of the flash is write-protected).
  5. You'll see a lot of error output, but relax: this is normal. It will look something like this:
    Reading old flash chip contents... done.
    Erasing and writing flash chip... spi_block_erase_20 failed during command execution at address 0x0
    Reading current flash chip contents... done. Looking for another erase function.
    spi_block_erase_52 failed during command execution at address 0x0
    Reading current flash chip contents... done. Looking for another erase function.
    Transaction error!
    spi_block_erase_d8 failed during command execution at address 0x1f0000
    Reading current flash chip contents... done. Looking for another erase function.
    spi_chip_erase_60 failed during command execution
    Reading current flash chip contents... done. Looking for another erase function.
    spi_chip_erase_c7 failed during command execution
    Looking for another erase function.
    No usable erase functions left.
    FAILED!
    Uh oh. Erase/write failed. Checking if anything has changed.
    Reading current flash chip contents... done.
    Apparently at least some data has changed.
    Your flash chip is in an unknown state.
  1. If the errors are like that then, contrary to the error output, the image was flashed successfully.
    • If they don't match, DO NOT TURN OFF YOUR LAPTOP; get help instead.
  2. Shut down the laptop (fully shut it down, as in, turn it off), and then boot it again in a few seconds. Your laptop will boot into Coreboot.
Note: SeaBIOS will not display anything without a proprietary VGABIOS blob (Intel or ATI GPU) or (Intel GPU only) the free SeaVGABIOS ("coreboot linear framebuffer" in SeaBIOS menuconfig) option ROM in SeaBIOS combined with native graphics initialization, but GNU/Linux should work fine in any case.

Install Coreboot (Second Flash) (OLD)

Next, flash Coreboot a second time to overwrite the original boot block. This time, you can (and should) used an unpatched version of flashrom. Libreboot also comes with this, or (once again) you can also use upstream if you like.

  1. Run su to become root, and change to the libreboot_bin or libreboot_util directory.
    1. Run ./flashrom/i686/flashrom -p internal -w coreboot.rom
    2. It should say Verifying flash... VERIFIED at the end of the output. If not, get help.
  2. Reset bucts back to normal (only if the step above worked):
    1. Run bucts 0
  3. Reboot the laptop. Coreboot has been successfully installed.

Recovery with a Hardware Firmware Flasher

If you had a bad flash you will need to use a hardware flasher to reflash the BIOS.

If you want something that's easy to follow, the libreboot project shows how to flash externally using a BeagleBone Black

Coreboot standard configuration

  • It's now the default that when running SeaBios, that it (instead of coreboot) runs the VGA option rom.

See VGA_support for details on how to include the VGA BIOS image.

Recently tested revisions on the X60

See the most recent board-status submissions

970ad7076388b3ef98988121170df86196d493b4 coreboot-4.0-5534-g970ad70

8496c4dbec41b3a9284fc29b0dcd97fc8946223b coreboot-4.0-5045-g9bf05de

Recently tested revisions on the T60

See the most recent board-status submisssions

a172ea546992c3f6f6a99b4dbaabbdae4c959707 4.0-5611-ga172ea5

9bf05de5ab2842fc83cea8da5e9058417fc4bc24 4.0-5045-g9bf05de

Status

OLD INFO

The status and installation pages used to be one in the same.

This page underwent massive changes, some of which weren't good. Below is a copy of what used to be on the old page:

Flashing on the laptop instructions.

Lenovo X60, X60s, T60 and T60p flashing instructions.

These Lenovo laptops have a register that must be flipped before coreboot can be flashed.

For those/some models with SPI flash chips you have also to modify flashrom. Because the chipset locks down the available commands that flashrom can send to the flash chip, you also need to change the flashrom source in a way that is not suitable to upstream. Flash chips can be identified by various commands (REMS*, RDID etc.). Some of them reply with an ID for the vendor and the exact chip model; others just reply with a single byte which is fine if there is only a small number of chips to distinguish, but won't work for the huge number of flash chips known to flashrom. The problem with the vendor BIOS is that it forbids the higher quality identification commands, so you need to force flashrom to use the lower quality opcode for the chip in your Thinkpad. You have to know the chip model beforehand (e.g. by inspection). Known models on the x60s are SST25VF016B, MX25L1605D and maybe others.

You will need: the flashrom source (at least r1613 to make sure the laptops are whitelisted to work with flashrom), a small modification of it (as explained below in detail), and the bucts utility.

  1. Patch flashrom to use RES SPI identification and spi_chip_write_1 for your flash chip, as well as change the flash chip model id to fit the RES opcode.
    • Find the definition of your flash chip in flashrom's flashchips.c
      • Optionally, you can copy the existing definition as it is done in this patch. This will allow to switch between the two definitions with the -c parameter. Be sure to change the .name field in that case (e.g. .name = "SST25VF016B-RES",).
    • Change the .probe field to probe_spi_resN where N equals the number of ID bytes the flash replies to the RES ID command (e.g. .probe = probe_spi_res2, if the chip replies with one byte vendor ID and one byte model ID)
    • Change the .model_id field to the RES model ID given in the datasheet of the flash chip (e.g. .model_id = 0x14,)
    • Change the .write field to spi_chip_write_1 (i.e. .write = spi_chip_write_1,)
  2. Run flashrom -p internal -r factory.bin
    This step is IMPORTANT since the factory BIOS in your machine is tied to your particular system board (or "planar" in IBM FRU terms) with a unique ID not present in factory BIOS updates.
  3. Run dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k
  4. Run dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump
    Verify that the complete range is filled with ff bytes before proceeding! The above command must output:
    0000000 ffff ffff ffff ffff ffff ffff ffff ffff
    *
    0010000
    If this is not the case, the coreboot image needs to be rebuilt with the second-to-last 64kbyte block unused.
  5. Run dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc
  6. Run bucts 1
  7. Run flashrom -p internal -w coreboot.rom
    This will be slow, it will output errors for addresses 0x0 and 0x1f0000 when working with a 2 Mbyte flash chip, and it will say "FAILED!" at the end, see Peter's mail before you panic.
  8. Power cycle the machine (i.e. a cold boot, not just a reboot), now starting with coreboot
  9. Revert all changes made to flashrom (maybe backup the binary for later experiments)
  10. Run flashrom -p internal -w coreboot.rom.
    This will successfully overwrite the entire flash chip, including the last 64k that were write protected with the factory BIOS.
  11. Run bucts 0


See also http://thread.gmane.org/gmane.linux.bios/69354 http://thread.gmane.org/gmane.linux.bios.flashrom/575

Recovery

If you had a bad flash you will need a recovery method.

If you only set bucts, then rebooted without doing any flash writes, things might be easier: bucts sets a register that lives on the RTC well, ie. it is powered by the same source that keeps the clock alive. Usually that's a battery on the mainboard, and often there's some way to cut the source (by removing the battery, a jumper, or pads that can be shorted). After doing that (for a few seconds, there might be some capacitors in the way that keep power stable), the register should be reset and the system should boot as normal.

On the x60x, bucts issues might also be solved by "discarging RTC", which is done by pressing the power button 5 times for 10 seconds.

Required/advised hardware and informations

Howto

0. wire the pomona clip to a programmer that way:

From the #coreboot IRC Channel on FreeNode servers:

Oct 01 15:35:48 <CareBear\>     one important thing is that when you connect the clip to the X60 you should not connect all pins
[...]
Oct 01 15:36:22 <CareBear\>     only connect these pins: 1, 2, 4, 5, 6
[...]
Oct 01 15:37:21 <CareBear\>     also important: first connect charger to laptop, then connect the clip
[...]
Oct 01 17:49:41 <CareBear\>     GNUtoo-desktop : the mainboard must be powered off, but with the charger connected
[...]
Oct 01 17:50:39 <CareBear\>     um, that way there is no way anything will break
[...]
Oct 01 17:51:00 <CareBear\>     it is important not to connect 3v3 from the outside
Oct 01 17:51:39 <CareBear\>     because the correct power sequencing is not known, and if any other rail must come on before the standby 3v3 then the machine may well break when 3v3 is applied from the outside
[...]
Oct 01 17:52:48 <CareBear\>     it may also be fine - but it is unknown what happens
[...]
Oct 01 17:53:47 <CareBear\>     not supplying 3v3 from the outside is safer
Oct 01 17:54:25 <CareBear\>     and because the machine is powered off, there is no risk of the chipset accessing the flash chip

In another hand I didn't follow that and wired it without powering the mainboard(mainboard disconnected from power plug, no battery in) and with all pins and it worked...

  1. Disassemble carefully the laptop, the SO-8 chip is on the bottom of the mainboard...
  2. connect the pomona clip to the BIOS chip
  3. flash coreboot or the BIOS
  4. remount the laptop

Coreboot standard configuration

  • It's advised to make SeaBios(instead of coreboot) run the VGA option rom by disabling CONFIG_VGA_ROM_RUN:
[ ] Run VGA Option ROMs

in make menuconfig. Note that you still need to include the option rom in coreboot:

[*] Add a VGA BIOS image

See VGA_support for details on how to include the VGA BIOS image.

  • Also disable CONFIG_S3_VGA_ROM_RUN which is for really old linux kernels(2.4) (which is disabled automatically if you don't select CONFIG_VGA_ROM_RUN).

From the #coreboot IRC Channel on FreeNode servers:

Oct 04 13:47:09 <patrickg>      that's about running vga init on s3 wakeup - required for some older linux kernels
[...]
Oct 04 13:47:25 <patrickg>      BIOSes call it "POST on wakeup" or sth like that
Oct 04 13:47:30 <patrickg>      older ~ 2.4 class ;)

Status