From dc928ba2a6028f2012fe59595d09ad391fd4469d Mon Sep 17 00:00:00 2001
From: Francis Rowe
+ On the R400, the MAC address for the onboard + gigabit ethernet chipset is stored inside the flash chip, + along with other configuration data. +
++ Keep a note of the MAC address before disassembly; this is + very important, because you will need to insert this into + the libreboot ROM image before flashing it. + It will be written in one of these locations: +
+ ++ + + +
+ +Refer to bbb_setup.html for how to @@ -124,29 +148,186 @@ POMONA 5250 (correlate with the BBB guide) === slot where the AC jack is connected === -
+ Remove all screws:
+
+ Remove the HDD and optical drive:
+
+ Remove the hinge screws:
+
+
+
+ Remove the palm rest and keyboard:
+
+
+
+ Remove these screws, and then remove the bezel:
+
+
+
+ Remove the speaker screws, but don't remove the speakers yet
+ (just set them loose):
+
+
+
+
+ Remove these screws, and then remove the metal plate:
+
+
+
+
+ Remove the antennas from the wifi card, and then
+ start unrouting them:
+
+
+
+
+
+
+
+ Disconnect the LCD cable from the motherboard:
+
+
+
+
+
+ Remove the hinge screws, and then remove the LCD panel:
+
+
+
+
+
+ Remove this:
+
+
+
+ Remove this long cable (there are 3 connections):
+
+
+
+
+
+ Disconnect the speaker cable, and remove the speakers:
+
+
+ Remove the heatsink screws, remove the fan
+ and then remove the heatsink/fan:
+
+
+
+
+
+ Remove the NVRAM battery:
+
+
+
- The following photo shows an R400 flashed using the BBB:
-
+ Remove this screw:
+
+
+ Disconnect the AC jack:
+
+
+
+ Remove this screw and then remove what is under it:
+
+
+ Remove this:
+
+
+ Lift the motherboard (which is still inside the cage)
+ from the side on the right, removing it completely:
+
+
+
- No disassembly instructions yet, unfortunately. Check videos online or - look at the Hardware Maintenance Manual from Lenovo for this machine. - You will need to completely disassemble the machine, removing the motherboard - from its metal shell. - Connect your 5252/5250 (make sure to get it the right way round). - Then connect the 3.3v PSU wire (red one) and make sure that everything else is connected. + Remove all screws, marking each hole so that you know + where to re-insert them. You should place the screws in + a layout corresponding to the order that they were in + before removal: + +
+ +
+ Remove the motherboard from the cage, and the SPI flash
+ chip will be next to the memory slots:
+
+
+
+ Connect your programmer, then connect GND and 3.3V
+
+
+
+
+
+
+
+ A dedicated 3.3V PSU was used to create this guide, but
+ at ATX PSU is also fine:
+
+
+ Of course, make sure to turn on your PSU:
+
+
+ Now, you should be ready to install libreboot. +
+Flashrom binaries for ARM (tested on a BBB) are distributed in libreboot_util. Alternatively, libreboot also distributes flashrom source code which can be built.
- I did (SSH'd into the BBB):
+ Log in as root on your BBB, using the instructions in bbb_setup.html#bbb_access.
+
+ Test that flashrom works:
# ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512
- In my case, the output was:
+ In this case, the output was:
flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l) @@ -159,46 +340,38 @@ Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)&q Please specify which chip definition to use with the -c <chipname> option.
- This is just to test that it's working. In my case, I had to define which chip to use, like so (in your case
- it may be different, depending on what flash chip you have):
- # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)"
-
- At this point, you need to create a copy of the original lenovo firmware that is currently flashed. - This is so that you can extract the gbe (gigabit ethernet) and flash descriptor regions for use in libreboot. These - are not blobs, they only contain non-functional data (configuration details, fully readable) which is fully documented in public datasheets. - The descriptor will need to be modified - to disable the ME (also disable AMT) so that you can flash a ROM that excludes it. -
-
How to backup factory.rom (change the -c option as neeed, for your flash chip):
- # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory.rom
- # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory1.rom
- # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -r factory2.rom
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory.rom
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory1.rom
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r factory2.rom
+ Note: the -c option is not required in libreboot's patched flashrom, because
+ the redundant flash chip definitions in flashchips.c have been removed.
Now compare the 3 images:
# sha512sum factory*.rom
If the hashes match, then just copy one of them (the factory.rom) to a safe place (on a drive connected to another machine, not
- the BBB). You will need it later for part of the deblobbing.
+ the BBB). This is useful for reverse engineering work, if there is a desirable behaviour in the original firmware
+ that could be replicated in coreboot and libreboot.
+
+ Follow the instructions at ../hcl/gm45_remove_me.html#ich9gen + to change the MAC address inside the libreboot ROM image, before flashing it. + Although there is a default MAC address inside the ROM image, this is not what you want. Make sure + to always change the MAC address to one that is correct for your system.
- Information about the descriptor, gbe regions and how the ME was removed can be found in the notes linked at
- ../hcl/gm45_remove_me.html. Libreboot ROM images now include
- the 12KiB descriptor+gbe by default, generated using ich9gen;
- however, do note that the MAC address in the Gbe region is generic. Follow the instructions at
- ../hcl/gm45_remove_me.html#ich9gen and do what it says to change the MAC address
- inside your R400 ROM image, before flashing it.
+ Now flash it:
+ # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -w path/to/libreboot/rom/image.rom -V
- Assuming that your libreboot ROM image is properly setup (modified descriptor plus gbe region included in the ROM),
- then you can flash (assuming that the filename is libreboot.rom) for example I had to do:
- # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -c "MX25L6405(D)" -w libreboot.rom
+
You might see errors, but if it says Verifying flash... VERIFIED at the end, then it's flashed and should boot. - Test it! (boot your R400) + If you see errors, try again (and again, and again); the message Chip content is identical to the requested image + is also an indication of a successful installation.
- My output when running the command above: + Example output from running the command (see above):
flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l) @@ -212,6 +385,7 @@ Reading current flash chip contents... done. Looking for another erase function. Erase/write done. Verifying flash... VERIFIED.+
Back to top of page. @@ -244,14 +418,14 @@ Verifying flash... VERIFIED.
- The T400 typically comes with an Intel wifi chipset, which does not + The R400 typically comes with an Intel wifi chipset, which does not work without proprietary software. For a list of wifi chipsets that work without proprietary software, see ../hcl/index.html#recommended_wifi.
- Some T400 laptops might come with an Atheros chipset, but this is 802.11g only. + Some R400 laptops might come with an Atheros chipset, but this is 802.11g only.
@@ -263,7 +437,7 @@ Verifying flash... VERIFIED.
The following photos show an Atheros AR5B95 being installed, to
- replace the Intel chip that this T400 came with:
+ replace the Intel chip that this R400 came with:
+ You should see something like this: +
++ + +
+ ++ Now install GNU/Linux. +
+ +