+

Flashing the T500 with a BeagleBone Black

+ +

Initial flashing instructions for T500.

+

+ This guide is for those who want libreboot on their ThinkPad T500 + while they still have the original Lenovo BIOS present. This guide + can also be followed (adapted) if you brick your T500, to know how + to recover. +

+ +

Back to main index

+

+ +

A note about CPUs

+

+ ThinkWiki has a list of CPUs + for this system. The Core 2 Duo P8400, P8600 and P8700 are believed to work in libreboot. + The T9400, T9500, T9550 and T9600 are untested! +

+ +

A note about GPUs

+ +

+ This guide currently assumes that you have an Intel GPU (non-switchable). + Some T500 have switchable graphics (ATI), which means that you can choose between ATI or Intel + in the BIOS setup. When switching to Intel, is lenovobios not enabling ATI + (where ATI is disabled by default and the system uses the Intel chip), or are they + disabling it (where the system uses the ATI chip by default)? +

+ +

+ Basically, switchable graphics is untested, but it should be easy to get it working + (if it doesn't already work). +

+ +

CPU paste required

+ +

+ See #paste. +

+ +

Flash chips

+ +

+ The T500 will use an 8MiB or 64Mb SOIC-16 chip (rare models + will use a 4MiB or 32Mb SOIC-8 chip). +

+ +

+ Back to top of page. +

+ +

MAC address

+ +

+ On the T500, the MAC address for the onboard + gigabit ethernet chipset is stored inside the flash chip, + along with other configuration data. +

+

+ Keep a note of the MAC address before disassembly; this is + very important, because you will need to insert this into + the libreboot ROM image before flashing it. + It will be written in one of these locations: +

+ +

+ + + +

+ +

Initial BBB configuration

+ +

+ Refer to bbb_setup.html for how to + configure the BBB for flashing. +

+ +

+ The following shows how to connect clip to the BBB (on the P9 header), for SOIC-16 (clip: Pomona 5252): +

+

+POMONA 5252 (correlate with the BBB guide)
+===  ethernet jack and VGA port ====
+ NC              -       - 21
+ 1               -       - 17
+ NC              -       - NC
+ NC              -       - NC
+ NC              -       - NC
+ NC              -       - NC
+ 18              -       - 3.3V PSU RED
+ 22              -       - NC - this is pin 1 on the flash chip
+===  SATA port ===
+This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

+
+

+

+ The following shows how to connect clip to the BBB (on the P9 header), for SOIC-8 (clip: Pomona 5250): +

+

+POMONA 5250 (correlate with the BBB guide)
+===  RAM slots ====
+ 18              -       - 1
+ 22              -       - NC
+ NC              -       - 21
+ 3.3V PSU RED    -       - 17 - this is pin 1 on the flash chip
+===  slot where the AC jack is connected ===

+
+

+ +

+ The procedure +

+ +

+ Remove all screws:
+
+ It is also advisable to, throughout the disassembly, + place any screws and/or components that you removed in + the same layout or arrangement. The follow photos demonstrate + this:
+ + +

+

+ Remove the HDD/SSD and optical drive:
+ + +

+

+ Remove the palm rest:
+ + +

+

+ Remove the keyboard and rear bezel:
+ + + + + + +

+

+ If you have a WWAN/3G card and/or sim card reader, + remove them permanently. The WWAN-3G card has DMA, and + proprietary firmware inside; the technology is identical + to what is used in mobile phones, so it can also track + your movements:
+ + + +

+

+ Remove this frame, and then remove the wifi chip:
+ + + +

+

+ Remove the speakers:
+ + + + + + + +

+

+ Remove the NVRAM battery (already removed in this photo):
+ +

+

+ When you re-assemble, you will be replacing the wifi chip + with another. These two screws don't hold anything together, + but they are included in your machine because the screw + holes for half-height cards are a different size, so + use these if you will be installing a half-height card:
+ +

+

+ Unroute the antenna wires:
+ + + + +

+

+ Disconnect the LCD cable from the motherboard:
+ + +

+

+ Remove the LCD assembly hinge screws, and then remove the LCD + assembly:
+ + + +

+

+ Remove the fan and heatsink:
+ + + +

+

+ Remove this screw:
+ +

+

+ Remove these cables, keeping note of how and in what + arrangement they are connected:
+ + + + + + + + + +

+

+ Disconnect the power jack:
+ + +

+

+ Remove the motherboard and cage from the base + (the marked hole is where those cables were routed through):
+ + +

+

+ Remove all screws, arranging them in the same layout + when placing the screws on a surface and marking each screw + hole (this is to reduce the possibility of putting them + back in the wrong holes):
+ + +

+

+ Also remove this:
+ + +

+

+ Separate the motherboard from the cage:
+ + +

+

+ The flash chip is next to the memory slots. On this + machine, it was a SOIC-8 (4MiB or 32Mb) flash chip:
+ +

+

+ Connect your programmer, then connect GND and 3.3V
+
+ + + + +

+

+ A dedicated 3.3V PSU was used to create this guide, but + at ATX PSU is also fine:
+ +

+ +

+ Of course, make sure to turn on your PSU:
+ +

+ +

+ Now, you should be ready to install libreboot. +

+ +

+ Flashrom binaries for ARM (tested on a BBB) are distributed in libreboot_util. Alternatively, + libreboot also distributes flashrom source code which can be built. +

+

+ Log in as root on your BBB, using the instructions in bbb_setup.html#bbb_access. +

+

+ Test that flashrom works:
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512
+ In this case, the output was: +

+

+flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
+flashrom is free software, get the source code at http://www.flashrom.org
+Calibrating delay loop... OK.
+Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
+Found Macronix flash chip "MX25L6406E/MX25L6436E" (8192 kB, SPI) on linux_spi.
+Found Macronix flash chip "MX25L6445E/MX25L6473E" (8192 kB, SPI) on linux_spi.
+Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)", "MX25L6406E/MX25L6436E", "MX25L6445E/MX25L6473E"
+Please specify which chip definition to use with the -c <chipname> option.
+

+

+ How to backup factory.rom (change the -c option as neeed, for your flash chip):
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory.rom
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory1.rom
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory2.rom
+ Note: the -c option is not required in libreboot's patched flashrom, because + the redundant flash chip definitions in flashchips.c have been removed.
+ Now compare the 3 images:
+ # sha512sum factory*.rom
+ If the hashes match, then just copy one of them (the factory.rom) to a safe place (on a drive connected to another machine, not + the BBB). This is useful for reverse engineering work, if there is a desirable behaviour in the original firmware + that could be replicated in coreboot and libreboot. +

+

+ Follow the instructions at ../hcl/gm45_remove_me.html#ich9gen + to change the MAC address inside the libreboot ROM image, before flashing it. + Although there is a default MAC address inside the ROM image, this is not what you want. Make sure + to always change the MAC address to one that is correct for your system. +

+

+ Now flash it:
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -w path/to/libreboot/rom/image.rom -V +

+

+ +

+

+ You might see errors, but if it says Verifying flash... VERIFIED at the end, then it's flashed and should boot. + If you see errors, try again (and again, and again); the message Chip content is identical to the requested image + is also an indication of a successful installation. +

+

+ Example output from running the command (see above): +

+

+flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
+flashrom is free software, get the source code at http://www.flashrom.org
+Calibrating delay loop... OK.
+Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
+Reading old flash chip contents... done.
+Erasing and writing flash chip... FAILED at 0x00001000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x0000ffff: 0xd716
+ERASE FAILED!
+Reading current flash chip contents... done. Looking for another erase function.
+Erase/write done.
+Verifying flash... VERIFIED.
+

+ +

+ Back to top of page. +

+ +

Thermal paste (IMPORTANT)

+ +

+ Because part of this procedure involved removing the heatsink, you will need to apply new paste. + Arctic Silver 5 is ok. You will also need isopropyl alcohol and an anti-static cloth to clean with. +

+ +

+ When re-installing the heatsink, you must first clean off all old paste with the alcohol/cloth. + Then apply new paste. AS5 is also much better than the default paste used on these machines. +

+ +

Wifi

+ +

+ The T500 typically comes with an Intel wifi chipset, which does not + work without proprietary software. For a list of wifi chipsets that + work without proprietary software, see + ../hcl/index.html#recommended_wifi. +

+ +

+ Some T500 laptops might come with an Atheros chipset, but this is 802.11g only. +

+ +

+ It is recommended that you install a new wifi chipset. This can only + be done after installing libreboot, because the original firmware has + a whitelist of approved chips, and it will refuse to boot if you + use an 'unauthorized' wifi card. +

+ +

+ The following photos show an Atheros AR5B95 being installed, to + replace the Intel chip that this T500 came with:
+ + +

+ +

WWAN

+

+ If you have a WWAN/3G card and/or sim card reader, remove them permanently. + The WWAN-3G card has DMA, and proprietary firmware inside; the technology is + identical to what is used in mobile phones, so it can also track your movements. +

+

+ Not to be confused with wifi (wifi is fine). +

+ +

Memory

+ +

+ You need DDR3 SODIMM PC3-8500 RAM installed, in matching pairs + (speed/size). Non-matching pairs won't work. You can also install a + single module (meaning, one of the slots will be empty) in slot 0. +

+ +

+ The following photo shows 8GiB (2x4GiB) of RAM installed:
+ +

+ +

+ Boot it! +

+

+ You should see something like this: +

+

+ +

+ Now install GNU/Linux. +

+ +

+ Copyright © 2015 Francis Rowe <info@gluglug.org.uk>
+ This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

+ +

+ This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

+ +

+

WWAN

+

+ If you have a WWAN/3G card and/or sim card reader, remove them permanently. + The WWAN-3G card has DMA, and proprietary firmware inside; the technology is + identical to what is used in mobile phones, so it can also track your movements. +

+

+ Not to be confused with wifi (wifi is fine). +

+ +

+

Memory

diff --git a/docs/release.html b/docs/release.html index f5e11e5..fbeb1d5 100644 --- a/docs/release.html +++ b/docs/release.html @@ -50,7 +50,7 @@

Machines supported in this release:

- Lenovo ThinkPad X60/X60s + ThinkPad X60/X60s
- You can also remove the motherboard from an X61/X61s and replace it with an X60/X60s motherboard. @@ -59,14 +59,14 @@
- Lenovo ThinkPad X60 Tablet (1024x768 and 1400x1050) with digitizer support + ThinkPad X60 Tablet (1024x768 and 1400x1050) with digitizer support
- See hcl/index.html#supported_x60t_list for list of supported LCD panels
- It is unknown whether an X61 Tablet can have it's mainboard replaced with an X60 Tablet motherboard.
- Lenovo ThinkPad T60 (Intel GPU) (there are issues; see below): + ThinkPad T60 (Intel GPU) (there are issues; see below):
- See notes below for exceptions, and hcl/index.html#supported_t60_list for known working LCD panels.
- It is unknown whether a T61 can have it's mainboard replaced with a T60 motherboard.
- Lenovo ThinkPad X200 + ThinkPad X200
- X200S and X200 Tablet are also supported, conditionally; see hcl/x200.html#x200s
- ME/AMT: libreboot removes this, permanently. hcl/gm45_remove_me.html
- Lenovo ThinkPad R400 + ThinkPad R400
- See hcl/r400.html
- ME/AMT: libreboot removes this, permanently. hcl/gm45_remove_me.html
- Lenovo ThinkPad T400 + ThinkPad T400
- See hcl/t400.html
- ME/AMT: libreboot removes this, permanently. hcl/gm45_remove_me.html
+ ThinkPad T500 +
- See hcl/t500.html
- ME/AMT: libreboot removes this, permanently. hcl/gm45_remove_me.html
+
Apple MacBook1,1 (MA255LL/A, MA254LL/A, MA472LL/A)
- See hcl/index.html#macbook11.
- ThinkPad T500: http://projects.mtjm.eu/work_packages/42 -
ThinkPad R500: http://projects.mtjm.eu/work_packages/43
@@ -206,20 +210,27 @@
Platform-specific bugs
- - Fix these issues on GM45/GS45 targets: + HIGH PRIORITY! Fix these issues on GM45/GS45 targets:
  - X200: text-mode is broken. only framebuffer graphics work. Commit bde6d309dfafe58732ec46314a2d4c08974b62d4 in coreboot is what broke it. Investigate.
  - + Sound (internal speaker) worked on the T500, but stopped after all subsequent boots. + (might just be this machine). investigate. (external speaker works) +
- + Finish all work listed in future/index.html +
- Fix these issues on i945 targets (X60/T60/macbook21)
  - - HIGH PRIORITY! i945: Linux 3.19 doesn't boot. (probably affects T60/macbook21). + HIGH PRIORITY! i945: Linux 3.19 doesn't boot. (probably affects T60/macbook21). Preliminary bug report (kernel, linux) pstuge said http://biosbits.org/ patricg says https://wiki.ubuntu.com/HardwareEnablementTeam/Documentation/FirmwareTestSuiteLive @@ -277,6 +288,8 @@
    Build system
    
    +
    HIGH PRIORITY! Make memtest86+ build using coreboot's own crossgcc toolchain. Currently, + memtest86+ doesn't even work at all when cross-compiled using the toolchain in x86-64 trisquel7
    
    Make libreboot (all of it!) build reproducibly. This is very important. See http://projects.mtjm.eu/work_packages/16. @@ -291,8 +304,6 @@

+ ThinkPad T500 configuration (file: resources/libreboot/config/t500_4mb/config and resources/libreboot/config/t500_8mb/config) +

GM45 chipsets: remove the ME (manageability engine)

ThinkPad T500

+ Descriptor and Gbe differences +

Hardware register dumps

WWAN

Memory

WWAN

Memory

Flashing the T500 with a BeagleBone Black

A note about CPUs

A note about GPUs

CPU paste required

Flash chips

MAC address

Initial BBB configuration

+ The procedure +

Thermal paste (IMPORTANT)

Wifi

WWAN

Memory

+ Boot it! +

WWAN

Memory

Machines supported in this release:

Platform-specific bugs

Build system

Documentation improvements

Project (institutional) improvements