1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
|
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<style type="text/css">
@import url('../css/main.css');
</style>
<title>Installing libreboot</title>
</head>
<body>
<div class="section">
<h1 id="pagetop">Installing libreboot</h1>
<p>
This section relates to installing libreboot on supported targets.
</p>
<p>
<a href="../index.html">Back to previous index</a>
</p>
</div>
<div class="section">
<h2>Setting up external programmers</h2>
<ul>
<li><a href="bbb_setup.html">Setup the BeagleBone Black as an SPI flashrom programmer</a></li>
</ul>
<h2>Installing libreboot (software)</h2>
<ul>
<li><a href="#qemu">QEMU</a></li>
<li><a href="#rom">Recommended ROMs to flash</a></li>
<li><a href="#flashrom_lenovobios">X60/X60S/X60T/T60: How to flash your ROM (if running Lenovo BIOS firmware)</a></li>
<li><a href="#flashrom_macbook21">macbook21: How to flash your ROM (if running Apple EFI firmware)</a></li>
<li><a href="#flashrom">X60/X60S/X60T/T60/X200/R400/macbook21: How to flash your ROM (if running libreboot or coreboot already)</a></li>
</ul>
<h2>Installing libreboot (hardware)</h2>
<ul>
<li><a href="x60_unbrick.html">ThinkPad X60/X60S: How to unbrick</a></li>
<li><a href="x60tablet_unbrick.html">ThinkPad X60 Tablet: How to unbrick</a></li>
<li><a href="t60_unbrick.html">ThinkPad T60: How to unbrick</a></li>
<li><a href="x200_external.html">ThinkPad X200: How to unbrick</a> (also the initial installation guide for this machine)</li>
<li><a href="r400_external.html">ThinkPad R400: How to unbrick</a> (also the initial installation guide for this machine)</li>
</ul>
</div>
<div class="section">
<h1 id="qemu">QEMU</h1>
<p>
You don't really do anything here, just run (example):<br/>
$ <b>qemu-system-i386 -M pc -m 512 -bios bin/qemu_i440fx_piix4/qemu_i440fx_piix4_ukdvorak_vesafb.rom -serial stdio</b><br/>
$ <b>qemu-system-i386 -M q35 -m 512 -bios bin/qemu_q35_ich9/qemu_q35_ich9_ukdvorak_vesafb.rom -serial stdio</b>
</p>
<p>
<a href="#pagetop">Back to top of page</a>.
</p>
</div>
<div class="section">
<h1 id="rom">Recommended ROMs to flash</h1>
<p>
List of directories corresponding to each board:
</p>
<ul>
<li>ThinkPad X60, X60s and X60 Tablet: <b>bin/x60/</b></li>
<li>ThinkPad T60: <b>bin/t60/</b> (note, see <a href="../hcl/index.html#supported_t60_list">../hcl/index.html#supported_t60_list</a>)</li>
<li>ThinkPad X200: <b>bin/x200_8mb/</b> (8MiB flash chip) or <b>bin/x200_4mb</b> (4MiB flash chip) (see <a href="../hcl/x200.html">../hcl/x200.html</a>)</li>
<li>ThinkPad R400: <b>bin/r400_8mb/</b> (8MiB flash chip) or <b>bin/r400_4mb</b> (4MiB flash chip) (see <a href="../hcl/r400.html">../hcl/r400.html</a>)</li>
<li>Apple MacBook2,1: <b>bin/macbook21/</b></li>
<li>Apple MacBook1,1: <b>bin/macbook21/</b> (it's not a typo; the same ROMs work)</li>
</ul>
<p>These images use coreboot text-mode graphics:</p>
<ul>
<li>US Qwerty keyboard: <b><i>boardname</i>_usqwerty_txtmode.rom</b></li>
<li>UK Qwerty keyboard: <b><i>boardname</i>_ukqwerty_txtmode.rom</b></li>
<li>US Dvorak keyboard: <b><i>boardname</i>_usdvorak_txtmode.rom</b></li>
<li>UK Dvorak keyboard: <b><i>boardname</i>_ukdvorak_txtmode.rom</b></li>
<li>French Azerty keyboard: <b><i>boardname</i>_frazerty_txtmode.rom</b></li>
<li>French Dvorak (BEPO): <b><i>boardname</i>_frdvbepo_txtmode.rom</b></li>
<li>Italian Qwerty keyboard: <b><i>boardname</i>_itqwerty_txtmode.rom</b></li>
<li>Swedish Qwerty keyboard: <b><i>boardname</i>_svenska_txtmode.rom</b></li>
</ul>
<p>These images use coreboot framebuffer graphics:</p>
<ul>
<li>US Qwerty keyboard: <b><i>boardname</i>_usqwerty_vesafb.rom</b></li>
<li>UK Qwerty keyboard: <b><i>boardname</i>_ukqwerty_vesafb.rom</b></li>
<li>US Dvorak keyboard: <b><i>boardname</i>_usdvorak_vesafb.rom</b></li>
<li>UK Dvorak keyboard: <b><i>boardname</i>_ukdvorak_vesafb.rom</b></li>
<li>French Azerty keyboard: <b><i>boardname</i>_frazerty_vesafb.rom</b></li>
<li>French Dvorak (BEPO): <b><i>boardname</i>_frdvbepo_vesafb.rom</b></li>
<li>Italian Qwerty keyboard: <b><i>boardname</i>_itqwerty_vesafb.rom</b></li>
<li>Swedish Qwerty keyboard: <b><i>boardname</i>_svenska_vesafb.rom</b></li>
</ul>
<p>
The boards for <i>boardname</i> in the examples above can be found by the names of the directories
in <b>./bin/</b> or <b>./resources/libreboot/config/</b>.
</p>
<p>
_txtmode images come with MemTest86+.
_vesafb images are recommended in most cases.
</p>
<p>
This will give you your native keyboard layout inside GRUB. The preferences in your OS are not affected, it just makes using
the GRUB command line easier (if you ever need to do that).
<a href="../grub/index.html#grub_keyboard">../grub/index.html#grub_keyboard</a> shows you how this was done. If your native keyboard layout
differs, you can adapt those notes and hack the 'build' script for your needs.
</p>
<p><a href="#pagetop">Back to top of page.</a></p>
</div>
<div class="section">
<h1 id="flashrom_lenovobios">X60/X60S/X60T/T60: How to flash the ROMs onto your machine (if running Lenovo BIOS firmware).</h1>
<div class="important">
<p>
Hover over the next paragraph to make it black.
</p>
<p class="lenovobios">
Following this guide means simply flashing a libreboot ROM. This guide will not (directly) teach you how to make a backup (dump) of the original Lenovo BIOS
because to do so would be to explicitly endorse proprietary software. However, for the purposes of reverse engineering it can be useful
to have a backup. Each copy of the original Lenovo BIOS is tied to the specific machine that it came from; it will not run
on any other machine, even if it's the same type of machine as yours. What this means is that, effectively, you can back it up now (so that you can
re-flash it later if you want to run the original Lenovo BIOS again) or lose it forever. The X60/T60 installation
guide on the coreboot wiki will show you how to do this:
<a href="http://www.coreboot.org/Board:lenovo/x60/Installation">http://www.coreboot.org/Board:lenovo/x60/Installation</a>.<br/>
Do not make this decision lightly! This is your last and only chance.
</p>
<p>
The following is for the libreboot image and *not* the factory bios dump:
</p>
<p>
Check the last two 64K regions in your ROM file (libreboot.rom in this example):<br/>
<b>$ dd if=libreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s libreboot.rom) - 0x10000] count=64k</b><br/>
<b>$ dd if=libreboot.rom of=lower64k.bin bs=1 skip=$[$(stat -c %s libreboot.rom) - 0x20000] count=64k</b><br/>
<b>$ sha512sum lower64k.bin top64k.bin</b><br/>
Make *sure* that they match before you continue. The ROMs included pre-compiled in libreboot should already match.
If they don't match, then do this (based on those instructions from <a href="http://www.coreboot.org/Board:lenovo/x60/Installation">coreboot wiki</a>):<br/>
<b>$ dd if=top64k.bin of=libreboot.rom bs=1 seek=$[$(stat -c %s libreboot.rom) - 0x20000] count=64k conv=notrunc</b><br/>
After this, the ROM will be safe to flash. Explanation is provided in <a href="../git/index.html#build_bucts">../git/index.html#build_bucts</a>.
</p>
</div>
<p><b>This is for the ThinkPad X60 and T60 while running Lenovo BIOS. If you already have coreboot or libreboot running,
then go to <a href="#flashrom">#flashrom</a> instead!</b></p>
<p><b>If you are flashing a Lenovo ThinkPad T60, be sure to read <a href="../hcl/index.html#supported_t60_list">../hcl/index.html#supported_t60_list</a></b></p>
<div class="important">
<p>
<b>If you are using libreboot_src or git, then make sure that you built the sources first (see <a href="../git/index.html#build">../git/index.html#build</a>).</b>
</p>
</div>
<p>"YOURBOARD/YOURROM" should be replaced with what is correct as per <a href="#rom">#rom</a>. Alternatively
you may be using your own custom ROM. Adapt.</p>
<p>
Run the script:<br/>
<b>$ sudo ./lenovobios_firstflash bin/<a href="#rom">YOURBOARD/YOURROM</a>.</b>
</p>
<div class="important">
<p>
You should see within the output the following:<br/>
<b>"Updated BUC.TS=1 - 64kb address ranges at 0xFFFE0000 and 0xFFFF0000 are swapped"</b>.
</p>
<p>
You should also see within the output the following:<br/>
<b>"Flash chip is in an unknown state"</b>, <b>"FAILED"</b> and <b>"DO NOT SHUTDOWN OR REBOOT"</b><br/>
Seeing this means that the operation was a <b>resounding</b> success! <b>DON'T PANIC</b>.
</p>
<p>
See this link for more details:
<a href="http://thread.gmane.org/gmane.linux.bios.flashrom/575">http://thread.gmane.org/gmane.linux.bios.flashrom/575</a>.
</p>
<p>
If the above is what you see, then <b>SHUT DOWN</b>. Wait a few seconds, and then boot; libreboot is running, but there is a 2nd procedure <b>*needed*</b> (see below).
</p>
</div>
<p>
<b>
If you boot and you see nothing, try turning up the backlight (Fn+Home).
</b>
</p>
<p>
When you have booted up again:<br/>
<b>$ sudo ./lenovobios_secondflash bin/<a href="#rom">YOURBOARD/YOURROM</a></b>
</p>
<div class="important">
<p>
You should see within the output the following:<br/>
<b>"Updated BUC.TS=0 - 128kb address range 0xFFFE0000-0xFFFFFFFF is untranslated"</b>
</p>
<p>
You should also see within the output the following:<br/>
<b>"Verifying flash... VERIFIED."</b>
</p>
<p>Shut down again, wait a few seconds, and then boot.</p>
</div>
<p>
Some thinkpads come with WWAN cards installed, along with sim cards. These use non-free firmware and should be removed.
You might also want to remove bluetooth. See <a href="../security/x60_security.html">../security/x60_security.html</a> and
<a href="../security/t60_security.html">../security/t60_security.html</a>.
</p>
<p><a href="#pagetop">Back to top of page.</a></p>
</div>
<div class="section">
<h1 id="flashrom_macbook21">macbook21: How to flash your ROM (if running Apple EFI firmware)</h1>
<div class="important">
<p>
Hover over the next paragraph to make it black.
</p>
<p class="lenovobios">
Following this guide means simply flashing a libreboot ROM. This guide will not (directly) teach you how to make a backup (dump) of the original Apple EFI firmware
because to do so would be to explicitly endorse proprietary software. However, for the purposes of reverse engineering it can be useful
to have a backup. Each copy of the original Apple EFI is (believed, but unproven to be) tied to the specific machine that it came from; it will not (as is believed) run
on any other machine, even if it's the same type of machine as yours. What this means is that, effectively, you can back it up now (so that you can
re-flash it later if you want to run the original Apple EFI firmware again) or lose it forever. The macbook21 installation
guide on the coreboot wiki will show you how to do this:
<a href="http://www.coreboot.org/Board:apple/macbook21">http://www.coreboot.org/Board:apple/macbook21</a>.<br/>
Do not make this decision lightly! This is (very likely) your last and only chance.
</p>
<p>
(this theory is untested at the time of writing)
</p>
<p>
Note: <b>If you have a MacBook1,1 then these instructions will not work. See <a href="../hcl/index.html#macbook11">../hcl/index.html#macbook11</a> for MacBook1,1 flashing instructions.</b>
</p>
</div>
<p>
<b>
This is for the MacBook2,1 while running Apple EFI firmware. If you already have
coreboot or libreboot running, then go to <a href="#flashrom">#flashrom</a> instead!
</b>
</p>
<p>
Be sure to read the information in <a href="../hcl/index.html#macbook21">../hcl/index.html#macbook21</a>.
</p>
<div class="important">
<p>
<b>If you are using libreboot_src or git, then make sure that you built the sources first (see <a href="../git/index.html#build">../git/index.html#build</a>).</b>
</p>
</div>
<p>
Look at <a href="#rom">#rom</a> to see which ROM is suitable for your machine. Alternatively you may be using your own
custom ROM. Adapt.
</p>
<p>
Flashing is actually easy (compared to X60/T60).<br/>
<b>$ sudo flashrom -p internal:laptop=force_I_want_a_brick -w bin/<a href="#rom">YOURBOARD/YOURROM</a></b>
</p>
<p>
Alternatively, a script is provided which does the same thing:<br/>
<b>$ sudo ./macbook21_firstflash bin/<a href="#rom">YOURBOARD/YOURROM</a></b>
</p>
<div class="important">
<p>
You should also see within the output the following:<br/>
<b>"Verifying flash... VERIFIED."</b>
</p>
<p>
If you see that, great! Shut down now (power off). Wait a few seconds and then boot!
</p>
<p>
<b>
If you boot and you see nothing, try turning up the backlight (F2 for macbook21).
</b>
</p>
</div>
<p><a href="#pagetop">Back to top of page.</a></p>
</div>
<div class="section">
<h1 id="flashrom">X60/X60S/X60T/T60/X200/R400/macbook21: How to flash the ROMs onto your machine (if running libreboot or coreboot already)</h1>
<p>
<b>
These instructions work for the Lenovo ThinkPad X60/X60S/X60T/T60 and Apple MacBook2,1.
</b>
</p>
<p>
<b>
This assumes that you already have coreboot or libreboot running.
</b>
</p>
<p>
<b>
If you have Lenovo BIOS running (X60/X60S/X60T/T60), go to <a href="#flashrom_lenovobios">#flashrom_lenovobios</a> instead.
</b>
</p>
<p>
<b>
If you have Lenovo BIOS running (X200), go to <a href="x200_external.html">x200_external.html</a> instead.
</b>
</p>
<p>
<b>
If you have Lenovo BIOS running (R400), go to <a href="r400_external.html">r400_external.html</a> instead.
</b>
</p>
<p>
<b>
If you have Apple EFI firmware running (macbook21), go to <a href="#flashrom_macbook21">#flashrom_macbook21</a> instead.
</b>
</p>
<p>
<b>
If you are flashing a Lenovo ThinkPad T60, be sure to read <a href="../hcl/index.html#supported_t60_list">../hcl/index.html#supported_t60_list</a>.
</b>
</p>
<p>
<b>
If you have an X200 or R400 with libreboot or coreboot already running, note that
the Gbe in the boot flash contains your MAC address. You will need to change the default
MAC address inside the ROM images before flashing a new libreboot image. See
<a href="../hcl/gm45_remove_me.html#ich9gen">ich9gen</a> for details.
Another important note about the X200/R400: even if you do already have libreboot or coreboot,
it is possible for the user to write-protect regions in the flash chip, by modifying
the flash descriptor. If you have locked regions, you will need an external flasher
(see <a href="x200_external.html">x200_external.html</a> or <a href="x200_external.html">x200_external.html</a>)
to re-flash those regions. By default,
the X200 and R400 ROM images in libreboot contain a descriptor+gbe with all regions unlocked.
</b>
</p>
<p>
<b>
If you are flashing an Apple MacBook2,1, be sure to read the information in <a href="../hcl/index.html#macbook21">../hcl/index.html#macbook21</a>.
</b>
</p>
<div class="important">
<p>
<b>If you are using libreboot_src or git, then make sure that you built the sources first (see <a href="../git/index.html#build">../git/index.html#build</a>).</b>
</p>
</div>
<p>
Look at <a href="#rom">#rom</a> to see which ROM is suitable for your machine. Alternative you may be using your own
custom ROM. Adapt.
</p>
<p>
Flash the ROM:<br/>
<b>$ sudo ./flash bin/<a href="#rom">YOURBOARD/YOURROM</a></b>
</p>
<p>
If you are sure that you are flashing the correct image but you get the error
<b>This coreboot image (LENOVO:ThinkPad X60) does not appear to be correct for the detected mainboard (Lenovo:ThinkPad X60 / X60s / X60t) or
similar (if it's a different board), then do</b>:
<br/>
<b>$ sudo ./forceflash bin/<a href="#rom">YOURBOARD/YOURROM</a></b>
</p>
<div class="important">
<p>
You should see <b>"Verifying flash... VERIFIED."</b> written at the end of the flashrom output. <b>SHUT DOWN</b>
after you see this, and then boot up again after a few seconds.
</p>
<p>
<b>
If you boot and you see nothing, try turning up the backlight (Fn+Home for X60/X60S/X60T/T60/X200, F2 for macbook21).
</b>
</p>
</div>
<p>
Some thinkpads come with WWAN cards installed, along with sim cards. These use non-free firmware and should be removed.
You might also want to remove bluetooth. See <a href="../security/x60_security.html">../security/x60_security.html</a> and
<a href="../security/t60_security.html">../security/t60_security.html</a>.
</p>
<p><a href="#pagetop">Back to top of page</a></p>
</div>
<div class="section">
<p>
Copyright © 2014, 2015 Francis Rowe <info@gluglug.org.uk><br/>
This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions.
A copy of the license can be found at <a href="../license.txt">../license.txt</a>.
</p>
<p>
This document is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See <a href="../license.txt">../license.txt</a> for more information.
</p>
</div>
</body>
</html>
|
