Board:lenovo/x60/Installation

From coreboot
Jump to navigation Jump to search

The wiki is being retired!

Documentation is now handled by the same processes we use for code: Add something to the Documentation/ directory in the coreboot repo, and it will be rendered to https://doc.coreboot.org/. Contributions welcome!

These Coreboot/Libreboot flashing instructions are designed for the Lenovo X60, X60s, X60 tablet, T60 and T60p.

Libreboot Flashing Procedure (Easy Method)

Note: Libreboot is not officially part of the coreboot project. Do not contact coreboot for support; instead, contact the libreboot community.

The Libreboot distribution distributes pre-compiled ROM images along with scripts and instructions for easy flashing.

Note: If you choose to follow the Official Libreboot Documentation, make sure to follow the Lenovo BIOS Backup procedure details below.

Back up Official Lenovo BIOS (Libreboot)

It is STRONGLY RECOMMENDED to back up the vendor BIOS; each BIOS image has a unique, unrecoverable ID. Do not use another laptop's vendor BIOS image.

  1. Download, extract, and build the latest Libreboot binaries.
  2. From the libreboot_bin/ folder, enter the flashrom/ folder.
    cd flashrom
  3. Run both of these commands to backup the BIOS to factory.bin (don't panic, nothing is being installed):
    sudo ./flashrom_lenovobios_sst -p internal -r factory.bin
    sudo ./flashrom_lenovobios_macronix -p internal -r factory.bin -c "MX25L1605"
  4. If a factory.bin file was created in the flashrom/ folder, the Lenovo BIOS has been backed up successfully. If not, try the commands again. Copy this dump to a safe place.
  5. Return to the libreboot_bin/ folder.
    cd ..

Coreboot Flashing Procedure (Advanced)

Below is a procedure that describes all the steps needed to flash Coreboot, in fine detail.

The Libreboot scripts have fully automated this complicated process, so these instructions have been expanded for educational purposes.

Briefing

  • The BUCTS register bit must be flipped before flashing Coreboot.
    • The bucts utility can be used to flip the bit.
    • This register bit doubles as a unique safety feature that allows the vendor BIOS and Coreboot to coexist.
    • Just unplug the CMOS battery to return to the vendor BIOS, in case Coreboot doesn't boot.
  • Some SPI Flash chips require special flashrom patches.
    • Flash chips can be identified by various commands (REMS*, RDID etc.). Some of them reply with an ID for the vendor and the exact chip model; others just reply with a single byte.
    • Unfortunately, the vendor BIOS forbids higher quality identification commands, so flashrom must be patched to use the lower quality opcodes.
    • This type of patch will never be merged upstream, so we must apply them manually.
  • The Coreboot ROM has to be specially patched to prevent it from overwriting the vendor BIOS.
    • Just use this convenient little Bash one-liner to leave some free space at the beginning of the ROM.
    dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k; dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump; dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc
  • You have to know the flashchip type beforehand (e.g. by visual inspection).
    • Early Coreboot developers had to disassemble the entire laptop just to take a peek at the flashchip. A magnifying glass is needed to read the tiny text burned on top of the chip.
    • The Libreboot installation scripts have an ingenious new brute-force method of identifying the flashchip.
    • First, build two patched flashrom binaries, one for SST and one for Macronix. Then try both of the binaries until you find one that works.
    • Seems way too simple, but it's way better than ripping out the motherboard just to look at a chip.
  • List of known BIOS flashchips on the X60/T60:
    • SST25VF016B - Requires the SST patch.
    • MX25L1605D - Requires the Macronix patch.
    • Atmel ??? (no patching required) - Found only on a few T60 models. Not sure what the serial number is, but whatever.

What You Need

  • The flashrom source (at least r1613 to make sure the laptops are whitelisted to work with flashrom)
  • Flashrom patches for SST and Macronix flashchip support (provided in the next section).
  • The bucts utility.
  • Dependencies (Debian/Ubuntu/Trisquel):
    • Version Control - sudo apt-get install subversion git
    • Build Essentials - sudo apt-get -y install build-essential
    • flashrom - sudo apt-get install libpci-dev pciutils zlib1g-dev libftdi-dev
    • Coreboot - sudo apt-get install libncurses-dev iasl libc6-dev bison flex git
    • GRUB2 (optional) - sudo apt-get install bison libopts25 libselinux1-dev autogen m4 autoconf help2man libopts25-dev flex libfont-freetype-perl automake autotools-dev libfreetype6-dev texinfo ttf-unifont

Flashrom Patch Definitions

Source: BASQLC Libreboot ThinkPads - BIOS Flashchip Identification Method

Flashrom must be patched to use RES SPI identification and spi_chip_write_1 for your flash chip, and to set the flash chip model_id to the RES opcode.

Below are the definitions that must be patched into flashrom/flashchips.c :

  • SST25VF016B
    • .probe - probe_spi_res1
    • .model_id - 0xbf
    • .write - spi_chip_write_1
  • MX25l1605D
    • .probe - probe_spi_res1
    • .model_id - 0x14
    • .write - spi_chip_write_1
  • Atmel ??? (T60 Only?)
    • No patches necessary.

These definitions were painstakingly discovered from the output of flashrom, through the power of conjecture and lots of testing. See this wiki page for more information.

Patch Flashrom

Source: BASQLC Libreboot ThinkPads - Flashrom Patches

This method uses the brute force flashchip identification method used in the Libreboot flashing scripts. The idea is, if the patched flashrom can't identify the chip, it won't do anything; so why not try both patches?

The most reliable method to identify the flashchip is to visually identify it; but flipping the motherboard requires complete disassembly.

First, build both the SST and Macronix patches of Flashrom.

Step 1: Build SST-patched Flashrom

  1. Open the flashchips.c file in the flashrom source code folder.
  2. Use Ctrl-F to find the SST25VF016B entry.
  3. Modify the .probe , .model_id , and .write definitions with the following values.
    • .probe - probe_spi_res1
    • .model_id - 0xbf
    • .write - spi_chip_write_1
  4. The result should look something like this:
{
        .vendor         = "SST",
        .name           = "SST25VF016B",
        .bustype        = BUS_SPI,
        .manufacture_id = SST_ID,
        .model_id       = 0xbf,
        .total_size     = 2048,
        .page_size      = 256,
        .feature_bits   = FEATURE_WRSR_EITHER,
        .tested         = TEST_OK_PREW,
        .probe          = probe_spi_res1,
        /*
          unimportant code statements
          in between, leave them alone
        */
        .write          = spi_chip_write_1,
        .read           = spi_chip_read,
        .voltage        = {2700, 3600},
},
  1. Build flashrom using the make command.
    make
  2. Rename the flashrom binary to flashrom_lenovobios_sst .
    mv flashrom flashrom_lenovobios_sst

Step 2: Build Macronix-patched Flashrom

  1. Use Ctrl-F to find the SST25VF016B entry.
  2. Modify the .probe , .model_id , and .write definitions with the following values.
    • .probe - probe_spi_res1
    • .model_id - 0x14
    • .write - spi_chip_write_1
  3. The result should look something like this:
{
        .vendor         = "Macronix",
        .name           = "MX25L1605D/MX25L1608D/MX25L1673E",
        .bustype        = BUS_SPI,
        .manufacture_id = MACRONIX_ID,
        .model_id       = 0x14,
        .total_size     = 2048,
        .page_size      = 256,
        .feature_bits   = FEATURE_WRSR_WREN,
        .tested         = TEST_OK_PREW,
        .probe          = probe_spi_res1,
        /*
          unimportant code statements
          in between, leave them alone
        */
        .write          = spi_chip_write_1,
        .read           = spi_chip_read, /* Fast read (0x0B), dual I/O supported */
        .voltage        = {2700, 3600},
},
  1. Build flashrom using the make command.
    make
  2. Rename the flashrom binary to flashrom_lenovobios_macronix .
    mv flashrom flashrom_lenovobios_macronix

Back up Official Lenovo BIOS

It is STRONGLY RECOMMENDED to back up the vendor BIOS; each BIOS image has a unique, unrecoverable ID. Do not use another laptop's vendor BIOS image.

  1. Enter the flashrom/ folder.
    cd flashrom
  2. Run both of these commands to backup the BIOS to factory.bin (don't panic, nothing is being installed):
    sudo ./flashrom_lenovobios_sst -p internal -r factory.bin
    sudo ./flashrom_lenovobios_macronix -p internal -r factory.bin -c "MX25L1605"
  3. If a factory.bin file was created in the flashrom/ folder, the Lenovo BIOS has been backed up successfully. If not, try the commands again. Copy this dump to a safe place.
  4. Return to the libreboot_bin/ folder.
    cd ..

Build the Coreboot ROM

  • See Build HOWTO for how to build ROM images in coreboot.
    • (optional) If you need to obtain and embed the VGABIOS in Coreboot (e.g. T60 with ATI GPU, text in SeaBIOS), follow this procedure.
    • Here is a clearer guide which shows exactly how to build Coreboot, set up the .config file, and embed the VGABIOS.

Patch Coreboot ROM

This patch prevents the ROM from overwriting the vendor BIOS. It provides a safety net in case Coreboot does not run the first time, thanks to bucts 1.

Choose one method:

Method 1: One-line Patcher

  1. Place the coreboot.rom file in the current folder.
  2. Run this one-liner to patch the ROM in one command:
    dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k; dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump; dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc

Method 2: Verbose Method

  1. Copy the built coreboot.rom to the flashrom source code folder.
  2. Run the dd command below to shift the first 64K of data from coreboot.rom
    dd if=coreboot.rom of=top64k.bin bs=1 skip=[(stat -c %s coreboot.rom) - 0x10000] count=64k
  3. Run the dd command below to display the first 64k of coreboot.rom
    dd if=coreboot.rom bs=1 skip=[(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump
  4. Verify that the complete range is filled with ff bytes before proceeding.
    The output of the dd command above must EXACTLY match the text below. If not, the coreboot image needs to be rebuilt with the second-to-last 64kbyte block unused.
    0000000 ffff ffff ffff ffff ffff ffff ffff ffff *0010000
  5. Run the dd command below:
    dd if=top64k.bin of=coreboot.rom bs=1 seek=[(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc

Install Coreboot (First Flash)

First, install Coreboot alongside the vendor BIOS.

  1. Run su to become root.
  2. Run bucts 1
  3. Run flashrom -p internal -w coreboot.rom
    • This will take a while, and will spit out a few errors (since half the flashchip is write protected).
  4. Check to make sure that the errors match the following:
   Reading old flash chip contents... done.
   Erasing and writing flash chip... spi_block_erase_20 failed during command execution at address 0x0
   Reading current flash chip contents... done. Looking for another erase function.
   spi_block_erase_52 failed during command execution at address 0x0
   Reading current flash chip contents... done. Looking for another erase function.
   Transaction error!
   spi_block_erase_d8 failed during command execution at address 0x1f0000
   Reading current flash chip contents... done. Looking for another erase function.
   spi_chip_erase_60 failed during command execution
   Reading current flash chip contents... done. Looking for another erase function.
   spi_chip_erase_c7 failed during command execution
   Looking for another erase function.
   No usable erase functions left.
   FAILED!
   Uh oh. Erase/write failed. Checking if anything has changed.
   Reading current flash chip contents...  until done.
   Apparently at least some data has changed.
   Your flash chip is in an unknown state.
  1. If the errors are an exact match, the flash was successful.
    • If they don't match, DO NOT TURN OFF YOUR LAPTOP. Flash again.
  2. Power cycle the machine (i.e. a cold boot, not just a reboot). Your laptop will reboot into Coreboot.
    • Note: SeaBIOS will not display anything without a proprietary VGABIOS blob. However, Linux should work fine after booting.

Install Coreboot (Second Flash)

Next, flash Coreboot a second time to overwrite the vendor BIOS.

  1. Download a fresh copy of the flashrom source code (Save your patched flashrom for future use).
  2. Run su to become root.
  3. Run flashrom -p internal -w coreboot.rom.
    This will successfully overwrite the entire flash chip with no errors, including the last 64k that were write protected with the factory BIOS.
  4. Run bucts 0
  5. Reboot the laptop. Coreboot has been successfully installed.

Recovery

If you had a bad flash you will need a recovery method.

The libreboot project has picture guides showing disassembly and external flashing instructions (these 3 links are to the libreboot project. Contact libreboot, *not* coreboot, for support):

The libreboot guides linked above are based on the information below from the coreboot project:

If you only set bucts, then rebooted without doing any flash writes, things might be easier: bucts sets a register that lives on the RTC well, ie. it is powered by the same source that keeps the clock alive. Usually that's a battery on the mainboard, and often there's some way to cut the source (by removing the battery, a jumper, or pads that can be shorted). After doing that (for a few seconds, there might be some capacitors in the way that keep power stable), the register should be reset and the system should boot as normal.

On the x60x, bucts issues might also be solved by "discarging RTC", which is done by pressing the power button 5 times for 10 seconds.

Required/advised hardware and informations

Howto

0. wire the pomona clip to a programmer that way:

From the #coreboot IRC Channel on FreeNode servers:

Oct 01 15:35:48 <CareBear\>     one important thing is that when you connect the clip to the X60 you should not connect all pins
[...]
Oct 01 15:36:22 <CareBear\>     only connect these pins: 1, 2, 4, 5, 6
[...]
Oct 01 15:37:21 <CareBear\>     also important: first connect charger to laptop, then connect the clip
[...]
Oct 01 17:49:41 <CareBear\>     GNUtoo-desktop : the mainboard must be powered off, but with the charger connected
[...]
Oct 01 17:50:39 <CareBear\>     um, that way there is no way anything will break
[...]
Oct 01 17:51:00 <CareBear\>     it is important not to connect 3v3 from the outside
Oct 01 17:51:39 <CareBear\>     because the correct power sequencing is not known, and if any other rail must come on before the standby 3v3 then the machine may well break when 3v3 is applied from the outside
[...]
Oct 01 17:52:48 <CareBear\>     it may also be fine - but it is unknown what happens
[...]
Oct 01 17:53:47 <CareBear\>     not supplying 3v3 from the outside is safer
Oct 01 17:54:25 <CareBear\>     and because the machine is powered off, there is no risk of the chipset accessing the flash chip

In another hand I didn't follow that and wired it without powering the mainboard(mainboard disconnected from power plug, no battery in) and with all pins and it worked...

  1. Disassemble carefully the laptop, the SO-8 chip is on the bottom of the mainboard...
  2. connect the pomona clip to the BIOS chip
  3. flash coreboot or the BIOS
  4. remount the laptop

See also In-System Programming

Coreboot standard configuration

  • It's now the default that when running SeaBios, that it (instead of coreboot) runs the VGA option rom.

See VGA_support for details on how to include the VGA BIOS image.

VBIOS replacement (native graphics)

The VGA option ROM (see above) is proprietary. Under devices in menuconfig, disable loading option ROM,s and enable 'Native graphics initialization'. Use the GRUB payload.

TODO: add notes here for how to patch coreboot for T60 native graphics (it's in libreboot already, or on 5345 on coreboot gerrit).

Recently tested revisions on the X60

See the most recent board-status submissions

970ad7076388b3ef98988121170df86196d493b4 coreboot-4.0-5534-g970ad70

8496c4dbec41b3a9284fc29b0dcd97fc8946223b coreboot-4.0-5045-g9bf05de

Recently tested revisions on the T60

See the most recent board-status submisssions

a172ea546992c3f6f6a99b4dbaabbdae4c959707 4.0-5611-ga172ea5

9bf05de5ab2842fc83cea8da5e9058417fc4bc24 4.0-5045-g9bf05de

Status