libreboot.org 26 KB
what are these weird cables coming from my laptop?
red and blue are for 3g modem, white, gray and black are for wifi [16:21] that wide connector on a "tape" is for panel and indicator lights(sometimes microphone) on 3g modem card you should have markings for red and blue. for wifi google it. i don't know [16:23]
I do not even have to build the flashrom! Flashrom is in the debian archive!
https://libreboot.org/docs/gnulinux/grub_cbfs.html
$ sudo apt-get install flashrom
I should edit this is the website, because this website is one caotic mess!
ok I am supposed to use the textmode rom images for the first flash.
https://libreboot.org/docs/gnulinux/grub_cbfs.html
I want to use textmode for the first flash, because textmode includes a memtest, which you should always run after installing libreboot.
Preparing for the installation
If you've decided that you want to use libreboot! Congratulations. You are about to use a free BIOS! To perform the installation you will need:
- a rasberry PI Model B or B+ OR a beagle bone black
- essential things for the PI
- a keyboard
- a mouse (optional, but useful)
- computer screen
- HDMI cable to connect the screen to the PI
- 6 female jumper cables.
- a 16 Panorma clip and/or a 8 clip Panorama clip
If you have Linux already installed on your laptop, then before you
disassemble your T200, T400, T60, etc. laptop, install the flashrom
util apt-get install flashrom, and run the command flashrom -p
internal. The output of that command should tell you the size of
the flash chip. It could be 4MB, 8MB, or 16MB. The utility should
say 8192 Kb if it is a 8MB chip. You can still check your chip
size later on, but this is the easiest way to do it.
After you have done that, you may want to take a look at the guides online about possible upgrading your CPU. Libreboot supports certain CPU models. Since you are taking apart your laptop, now might be a good time to upgrade the CPU. Also take a look at your RAM. You might want to consider upgrading your RAM, since you are going to take apart your laptop. Also libreboot may not support your RAM. You might want to check online, which RAM libreboot supports. 1
After you have done that, ensure that you have a rasberry pi or beagle board and some female wires (10 females wires is plenty), and a panorama clip. Your flash chip will either have 8 or 16 connection points. You will only know once you take your laptop apart. You could buy two panorama clips, or just buy the 16 port one. If you know what you are doing, then you can use the 16 port one on an 8 port chip.
Now that you have all the parts that you need, go ahead and take your laptop apart. This guide, though quick, will give you some idea of how to take everything apart for the T400.
https://invidio.us/watch?v=xH1Gg-OhBH4
https://libreboot.org/docs/install/rpi_setup.html
A dedicated 3.3V PSU was used to create this guide, but at ATX PSU is also fine: (I believe my Macbook has an ATX PSU, this was developed by Intel).
Please note that this guide uses notation to help distinguish that you should run commands on a laptop vs. on the pi. They are:
pi$run this command as a regular user on the pi.pi#run this command as root on the pi.x86$run this command as a regular user on the computer.x86#run this command as a root user on a computer.
Upgrade your EC firmware version
If you are librebooting a Lenovo laptop X60, T60, X200, T400, T500, R400, or W500, then you need to update your laptop to the latest EC firmware version (version 1.06). Lenovo has some firmware for the laptop. Once you install Libreboot, there is no known way to update your EC firmware version.
To find out what firmware version you are using. You can boot into your Lenovo BIOS, and check it. If it says firmware version 1.06, then continue.
Alternatively, in GNU/Linux run this command:
#+BEGIN_SRC sh x86$ grep 'at EC' /proc/asound/cards #+END_SRC
#+RESULTS:
ThinkPad Console Audio Control at EC reg 0x30, fw 7WHT19WW-3.6
7WHT19WW is the version in different notation, use search engine to find out regular version - in this case it’s a 1.06 for x200 tablet
If your EC firmware is outdated, then you can use the Lenovo update utility to update your firmware. There is an option to burn it to a disk, and boot it. This will not work after you install libreboot. Make sure your update your EC firmware before installing libreboot!
More information, such as where to get the Lenovo EC firmware update utility is available here:
https://www.thinkwiki.org/wiki/BIOS_update_without_optical_disk
wiring the beagle bone black (or rasberry pi) and chip together
ONLY connect the panorama clip to the flash chip while the PI is off. Never connect the clip to the chip after you turned the pi on.
Rasberry Pi model B+
Here is a table that shows you all of the pin Locations on the Rasberry Pi B+
|------+-----+-----+----------------+----+----+---------------| | | | | 3v3 Power | 1 | 2 | 5v Power | | | | | BCM 2 (SDA) | 3 | 4 | 5v Power | | | | | BCM 3 (SCL) | 5 | 6 | Ground | | HDMI | | | BCM 4 (GPCLK0) | 7 | 8 | BCM 14 (TXD) | | | | | Ground | 9 | 10 | BCM 15 (RXD) | | | | | BCM 17 | 11 | 12 | BCM 18 (PWM0) | | | | | BCM 27 | 13 | 14 | Ground | | | | | BCM 22 | 15 | 16 | BCM 23 | | | | | 3v3 Power | 17 | 18 | BCM 24 | | | | | BCM 10 (MOSI) | 19 | 20 | Ground | | | | | BCM 9 (MISO) | 21 | 22 | BCM 25 | | | | | BCM 11 (SCLK) | 23 | 24 | BCM 8 (CE0) | | | | | Ground | 25 | 26 | BCM 7 (CE1) | | | | | BCM 0 (ID_SD) | 27 | 28 | BCM 1 (ID_SC) | | | | | BCM 5 | 29 | 30 | Ground | | | | | BCM 6 | 31 | 32 | BCM 12 (PWM0) | | | | | BCM 13 (PWM1) | 33 | 34 | Ground | | | | | BCM 19 (MISO) | 35 | 36 | BCM 16 | | | | | BCM 26 | 37 | 38 | BCM 20 (MOSI) | | | | | Ground | 39 | 40 | BCM 21 (SCLK) | | | | | | | | | | | | | | | | | | | | | | | | | | | USB | USB | | | | | |------+-----+-----+----------------+----+----+---------------|
This image is helpful if you have a 16 pin flash chip https://libreboot.org/docs/install/images/t400/0065.jpg
If you are using a 16 pin on a 16 chip flash, then chart should prove helpful:
# https://libreboot.org/docs/install/rpi_setup.html
|-----+----------+-------------------| | pin | SPI pin | rasberry pi pin # | | 1 | not used | not used | | 2 | 3.3V | 1 | | 3 | not used | not used | | 4 | not used | not used | | 5 | not used | not used | | 6 | not used | not used | | 7 | CS# | 24 | | 8 | S0/S1O1 | 21 | | 9 | not used | not used | | 10 | GND | 25 | | 11 | not used | not used | | 12 | not used | not used | | 13 | not used | not used | | 14 | not used | not used | | 15 | S1/SIO0 | 19 | | 16 | SCLK | 23 | |-----+----------+-------------------|
a note on powering the flash chip
At this point your laptop should be completly disassembled. Please inspect your flash chip to determine which kind you have. If it say "MX", then you have a Macronix chip. If it says something else then you have an SST chip.
In order to operate, the flash chip needs to be supplied with 3.3V power. Note: The raspberry pi 3.3V rail should be sufficient to power the chip during flashing, so no external power supply should be required; however, generally SST chips can use the 3.3V from the Ii to provide power to the chip, but this does not always work for the Macronix chips. If you have an SST chip, then you should have no issues; please skip to the next section. But if you have a Macronix chip, please read on.
While the 3.3V power supply of the pi should be enough in terms of voltage to power the Macronix chip, but it may not necessary provide enough current for flashing. Perhaps you could power up an arduino and use it's 3.3V power supply. Maybe that will work. Or you could use a shutoff laptop, with the power connector plugged in. In that case, you would need a usb to female wire adater to power the Macronix chip. If that fails, then you may need an external PSU (power supply unit) that can provide 3.3V.
ensure that you have spi devices enabled in the pi
https://www.raspberrypi-spy.co.uk/2014/08/enabling-the-spi-interface-on-the-raspberry-pi/
SPI is a communication protocol for microcontrollers. You need to enable it, to reflash your chip.
#+BEGIN_SRC sh pi# sudo raspi-config #+END_SRC
Choose 5 "Interfacing Options"
Choose P4 SPI "Enable/Disable automatic loading"
Would you like the SPI interface to be enabled?
Yes
Ok
testing to see if you can read the chip
Reboot now
Power on your Pi, and run the following. Ensure you swap out “your_chip_name” with the proper name/model of your chip. Check that it can be read successfully. If you cannot read the chip and receive an error similar to “no EEPROM Detected” then you may want to make sure that MISO/MOSI are not swapped around, check with multimeter whether voltage is right and that ground is connected between “programmer” and target.
If you do not know what kind of chip you have, then try running this command. The output should show you what type of chip you have. It should also tell you what size of chip that you have. 8192 kB is an 8MB chip. 4000 kB or so is a 4MB.
#+BEGIN_SRC sh pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 #+END_SRC
#+RESULTS
flashrom v1.2-14 flashrom is free software, get the source at https://flashrom.org Using clock_gettime for delay Found Macronix flash chip "MX25L6405" (8192 kB, SPI) on linux_spi. Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on linux_spi. Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on linux_spi.
:WhatTheOfficialGuideSays: Now that you know what kind and what size your chip is run these commands to read your flash rom three times.
These commands are for the SST chip.
#+BEGIN_SRC sh
pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0 -r romread1.rom
pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0 -r romread2.rom
pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0 -r romread3.rom
#+END_SRC
These commands are for the Macronix chip. You may need to replace
-c "MX25L6405D" with your chip name.
#+BEGIN_SRC sh pi# cd ~/flashrom
pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0 -c "MX25L6405D" -r romread1.rom
pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0 -c "MX25L6405D" -r romread2.rom
pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0 -c "MX25L6405D" -r romread3.rom
#+END_SRC
Now that you have read and save the factory rom image 3 times, verify that the pi has a good connection. Check that all files are the same.
#+BEGIN_SRC sh pi# sha512sum romread*.rom #+END_SRC
If they are identical sha512 hashes then you can generally assume that it’s safe to continue, because flashrom has managed to read the flashchip precisely (but not always accurately). :END:
We are almost ready to flash the chip, but we want to make sure that we can read the rom's contents reliably and that it has not been corrupted.
We will now run two commands. The first command will read the stock proprietary rom image in the chip. The second will verify that what we read is what is in the file, which means that we can probably read the flash rom chip reliably.
These commands are for the SST chip.
#+BEGIN_SRC sh pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0 -r romread.rom pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0 -v romread.rom #+END_SRC
These commands are for the Macronix chip. You may need to replace
-c "MX25L6405D" with your chip name.
#+BEGIN_SRC sh pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0 -c "MX25L6405D" -r romread.rom pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0 -c "MX25L6405D" -v romread.rom #+END_SRC
Now you need to look at the end of stock rom file. If you see a ton of error messages at the end of the rom, then we will need to patch flashrom. The strings command will find all strings in the binary file, which should give something recognizable.
#+BEGIN_SRC sh strings romread.rom #+END_SRC
Check the end of its output. You should see some garbled strings at the end of its output. Like this:
#+BEGIN_VERSE 2ne0 en22 esmj 2@e# enn43 #+END_VERSE
If instead you see it's filled with output like OxFF/Ox00 2, then you will need to patch flashrom to work with your poor setup.
You may also check the output with hexedit
#+BEGIN_SRC sh sudo apt-get install hexedit hexedit readrom.rom #+END_SRC
Once readrom opens, you need to navigate to the end of the file. type Return or Enter. hexedit will prompt you for a location. If it is an 8MB file type RETURN 0x80000. If it is an 4MB file type 0x40000. Once you are at the end of the file, look for any error messages. The error messages look like "0xFF/0x00". If you see any of those, then you will need to patch flashrom. C-c will close the program.
getting the rom images and libreboot util
HTTPS mirrors
| UK | https://www.mirrorservice.org/sites/libreboot.org/release/ | | USA | https://mirror.math.princeton.edu/pub/libreboot/ | | USA | https://mirror.splentity.com/libreboot/ | | | https://mirror.sugol.org/libreboot/ | | Spain | https://mirrors.qorg11.net/libreboot/ | | Netherlands | https://mirror.koddos.net/libreboot/ | | France | https://elgrande74.net/libreboot/ | | France | https://mirror.swordarmor.fr/libreboot/ | | France | https://mirror.cyberbits.eu/libreboot/ | | Hong Kong | https://mirror-hk.koddos.net/libreboot/ |
Use the 2016 09 07 version. https://libreboot.org/docs/gnulinux/grub_cbfs.html https://mirror.math.princeton.edu/pub/libreboot/stable/20160907/
A good rule of thumb is to flash the libreboot rom as is. Download the rom image. Do not worry about changing the default Mac address yet. You can do that after you reassemble your laptop.
Download libreboot util:
All of the following commands ought to be executed on the pi.
So, now we need to install flash rom, which will let us flash our libreboot image. Then we need to download and unpack the libreboot utilities.
#+BEGIN_SRC sh pi# apt-get install flashrom pi$ wget https://mirror.math.princeton.edu/pub/libreboot/stable/20160907/libreboot_r20160907_util.tar.xz pi$ tar -xf libreboot_r20160907_util.tar.xz pi$ mv "libreboot_r20160907_util" "libreboot_util" #+END_SRC
# https://libreboot.org/docs/gnulinux/grub_cbfs.html
To download the right size rom, you need to know the size of your Macronix chip. It can be either 4mb, 8mb, or 16mb.
If your chip is not 8mb, then change the file so that it says "16mb" or "4mb".
#+BEGIN_SRC sh pi$ cd ~/; pi$ wget pi$ https://mirror.math.princeton.edu/pub/libreboot/stable/20160907/rom/grub/libreboot_r20160907_grub_t400_8mb.tar.xz pi$ tar -xf libreboot_grub_r20160907_grub_t400_8mb.tar.gz pi$ cd libreboot_grub_r20160907_grub_t400_8mb; #+END_SRC
One you are in this directory look for your preferred keyboard layout, and select the roms that say textmode. Those roms include Memtest86+, which you should always run after installing libreboot.
:IGuessWeAreNotDownloadingLibrebootUtil:
#mv libreboot_grub_r20160907/t400_8mb_usdvorak_txtmode.rom ~/libreboot_util/ich9deblob/armv71/; #cd ~/libreboot_util/ich9deblob/armv71/; :END:
the actual command to flash the chip
The first command flashes the chip. The second command verifies that what you put on the chip matches the libreboot rom.
If your chip is an SST, then run this command. #+BEGIN_SRC sh pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0 -w /path/to/libreboot.rom pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0 -v /path/to/libreboot.rom #+END_SRC
If your chip is a Macronix, then run this command. #+BEGIN_SRC sh pi# ./flashrom -c "MX25L6405D" -p linux_spi:dev=/dev/spidev0.0 -w /path/to/libreboot.rom pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0 -c "MX25L6405D" -v /path/to/libreboot.rom #+END_SRC
The first command may fail a couple times, but keep trying. You
may even see some error messages, but if the command finishes with
Verifying flash... Verified or Warning: Chip content is
identical to the requested image then you’re done.
The second command should also say finish with something like
Verifying flash... Verified.
Once you have verified that the command succedded successfully, then flash has completed successfully. Congradulations you have just installed libreboot!
Shut down your pi, put your laptop back together and reboot into memtest.
On the first boot of libreboot, run memtest!
You will need to have flashed the libreboot image with txtmode to do this. Memtest3 only works with txtmode.
also test network before you start changing stuff in gbe region *wired network [10:15] everything should work fine with unmodified libreboot image [10:17] (besides memtest with 8GiB of ram, which will break on test #7 block move) [10:18]
** change the mac address in the libreboot rom https://libreboot.org/docs/hardware/mac_address.html
https://libreboot.org/docs/gnulinux/grub_cbfs.html#changeMAC
you attach the keyboard as well if you don't have RTC battery inserted then it will start up by itself
:WhatTheOfficialGuideSays:
Change MAC address in ROM
The last step before flashing the new ROM, is to change the MAC address inside it. Every libreboot ROM image contains a generic MAC address; you want to make sure that your ROM image contains yours, so as to not create any problems on your network (say, for example, that multiple family members had libreboot computers, and used the same ROM image to flash those computers).
To do this, we will use the ich9gen utility, also located in
libreboot_util. Luckily, you are already in the folder that provides
that command!
Once there, run the following command, making sure to use your own MAC address, instead of what’s written below:
My Mac address is 00:1C:25:9A:37:BA
#+BEGIN_SRC sh $ ./ich9gen --macaddress XX:XX:XX:XX:XX:XX #+END_SRC
Three new files will be created:
ich9fdgbe_4m.bin: this is for GM45 laptops with the 4MB flash chip.
ich9fdgbe_8m.bin: this is for GM45 laptops with the 8MB flash chip.
ich9fdgbe_16m.bin: this is for GM45 laptops with the 16MB flash chip.
Look for the one that corresponds to the size of your ROM image; for example, if your flash chip size is 8mb, you’ll want to use ich9fdgbe_8m.bin.
Now, insert this file (called the descriptor+gbe) into the ROM image, using dd:
#+BEGIN_SRC $ dd if=ich9fdgbe_8m.bin of=libreboot.rom bs=1 count=12k conv=notrunc #+END_SRC
Move libreboot.rom back to the libreboot_util directory:
#+BEGIN_SRC sh $ mv libreboot.rom ~/Downloads/libreboot_util; #+END_SRC
You are finally ready to flash the ROM! :END:
:NotNeededInfo: Flash Updated ROM Image
The last step of flashing the ROM requires us to change our current working directory to libreboot_util:
$ cd ~/Downloads/libreboot_util
Now, all we have to do is use the flash script in this directory, with the update option, using libreboot.rom as the argument:
$ sudo ./flash update libreboot.rom
Ocassionally, coreboot changes the name of a given board. If flashrom complains about a board mismatch, but you are sure that you chose the correct ROM image, then run this alternative command:
$ sudo ./flash forceupdate libreboot.rom
:END:
change the mac address in the libreboot rom
https://libreboot.org/docs/hardware/mac_address.html
https://libreboot.org/docs/gnulinux/grub_cbfs.html#changeMAC
FIXME. This needs to be updated. Only change the macaddress after you have successfully flashed libreboot. You should change the macadress via software methods. Change the macaddress via libreboot software updates after you have reassembled your laptop.
Change MAC address in ROM
The last step before flashing the new ROM, is to change the MAC address inside it. Every libreboot ROM image contains a generic MAC address; you want to make sure that your ROM image contains yours, so as to not create any problems on your network (say, for example, that multiple family members had libreboot computers, and used the same ROM image to flash those computers).
To do this, we will use the ich9gen utility, also located in
libreboot_util. Luckily, you are already in the folder that provides
that command!
Once there, run the following command, making sure to use your own MAC address, instead of what’s written below:
My Mac address is 00:1C:25:9A:37:BA
#+BEGIN_SRC sh $ ./ich9gen --macaddress XX:XX:XX:XX:XX:XX #+END_SRC
Three new files will be created:
ich9fdgbe_4m.bin: this is for GM45 laptops with the 4MB flash chip.
ich9fdgbe_8m.bin: this is for GM45 laptops with the 8MB flash chip.
ich9fdgbe_16m.bin: this is for GM45 laptops with the 16MB flash chip.
Look for the one that corresponds to the size of your ROM image; for example, if your flash chip size is 8mb, you’ll want to use ich9fdgbe_8m.bin.
Now, insert this file (called the descriptor+gbe) into the ROM image, using dd:
#+BEGIN_SRC $ dd if=ich9fdgbe_8m.bin of=libreboot.rom bs=1 count=12k conv=notrunc #+END_SRC
Move libreboot.rom back to the libreboot_util directory:
#+BEGIN_SRC sh $ mv libreboot.rom ~/Downloads/libreboot_util; #+END_SRC
You are finally ready to flash the ROM! :NotNeededInfo: Flash Updated ROM Image
The last step of flashing the ROM requires us to change our current working directory to libreboot_util:
$ cd ~/Downloads/libreboot_util
Now, all we have to do is use the flash script in this directory, with the update option, using libreboot.rom as the argument:
$ sudo ./flash update libreboot.rom
Ocassionally, coreboot changes the name of a given board. If flashrom complains about a board mismatch, but you are sure that you chose the correct ROM image, then run this alternative command:
$ sudo ./flash forceupdate libreboot.rom
:END:
I may also need to modify the grub rom.
I can do this after the flashing of libreboot, or I can do with with the pi. Either way is fine apparently.
If I do not modify the grub payload from libreboot, then I will need to type in grub commands at every boot, which would be super annoying. :)
I could also do some grub hardening
https://libreboot.org/docs/gnulinux/grub_hardening.html
GNU Guix System full disk encrypted
If I have a sim card reader I should remove it permantly.
https://libreboot.org/docs/gnulinux/guix_system.html
On reboot your internet may fail
It has proprietary fireware, so it can track my movements.
Essentially, when you tear your laptop apart, you may need to take out the BIOS battery. This may really offset your date. So when you try to connect to the internet, your computer will get weird responses. Your computer may be trying to tell the server that the year is 2120, when the year is actually 2020. If that happens, you may not be able to connect.
#+BEGIN_SRC sh date #+END_SRC
#+RESULTS:
Thu 4 Jan 2120 07:34:49 PM EDT
The fix for this is simple.
#+BEGIN_SRC sh date --set "Thu 26 Mar 2020 07:34:00 PM" #+END_SRC
#+RESULTS:
Now you should be able to connect to the internet super easily.
also minifree.org is done for
Minifree was the main developer of libre's commercial site. It is not defunct. But hopefully libreboot is still being developed? https://minifree.org/
Footnotes
the ram stick.
gone awfully wrong.
- The T200 and T400 support DDR3 ram. NOT DDR4 ram.
- 0x00/0xFF is an error message that detects that something has
- memtest should be run on any computer after you have touched