#689 [Script] Montevina ThinkPad: "Internal" Flashing via GPIO33 and a lot of steps

Open
opened 1 month ago by swiftgeek · 3 comments

Very early WIP

Warning: Unlike x60 method, this one yields bricks at any step being performed wrong. Therefore script has to perform all the checks to make sure it's safe to reboot. It will also make situation far worse for WSON8 users, lacking skills to replace the chip, when bricked.

Prerequisite:

  • Pogo pin with resistor soldered/connected to an usb plug (GND)/mounted to vga pin screw (Size M?)
    • USI targets: conical tip pogo
    • Wistron targets: crown shaped pogo
    • Maybe we can stretch dupont jumper cable a bit to fit pogo without soldering?
  • Masking tape
  • Docking station/UltraBase
  • USB Keyboard for stage1
  • Working Battery or UPS

Steps

  • Power off machine and remove all power sources, main/ultrabay batteries included.
  • Remove keyboard/palmrest and locate GPIO33 testpoint according to libreboot and/or vendor documentation
  • (partially) remove mylar if necessary, if partially then use tape to stick it down so you can work in GPIO33 testpoint area.
  • Punch a hole in masking tape and stick on board so only gpio33 is exposed. It takes only a moment to mask off area to prevent accidental shorts.
  • Attach battery, and if you have a dock plug into the dock/ultrabase
  • Pull GPIO33 low using pogo pin and hold it
  • Attach power. If machine is not powering on use power button on
  • Remove pogo once started to boot your operating system
  • [Script] stage 1:
    • read dmidecode and confirm device is supported
    • probe flash with flashrom, check if probe is successful. Confirm IFD protection is disabled.
    • Dump flash and backup it. ($timestamp-stage0-backup.img)
    • Confirm that IFD size matches Flash part size
    • Check if bootblock matches anything known as rest of the image cannot be easily checked for sanity by just reading it.
    • Check whether IFD layout matches any known vendor one.
    • generate nogbe libreboot ifd for given flash size.
    • Check whether both battery/PSU brick are plugged in and in good order
    • flash generated ifd
    • Dump flash and confirm valid IFD for flash ($timestamp-stage1-backup.img)
    • In case of errors recommend user to flash $timestamp-stage0-backup.img, and report issues on IRC
    • Erase RTC NVRAM
    • Poweroff
  • Remove Power/batteries, assemble device back together, attach power/batteries again.
  • Power on device
  • [Script] stage 2
    • Same checks as before but taking libreboot ifd into account
    • Check libreboot IFD being used and IFD restrictions being lifted
    • Generate IFD of following layout: ifd|bios|platform, where platform is covering bootblock and everything else is bios.
    • Generate Layout for flashing ifd and bios_rw (so vendor bios region minus bootblock)
    • Make sure that coreboot image fits into RW area of bios_rw area.
    • Flash ifd and coreboot into bios_rw area
    • flashrom -p internal -v image.img
    • Dump image ($timestamp-stage2-backup.img)
    • sync; sync; sync
    • Erase RTC NVRAM
  • This time yank out the power (both psu brick and battery)
    • We don't want flash contents to be mangled by vendor bios code
  • After couple of minutes reattach power and power it back on
  • [Script] stage 3 - finally on coreboot
    • Confirm all protections both IFD and PRx are gone
    • Confirm device from dmidecode and flash right image

Notes:

  • Masking tape isn't transparent so probably kapton is a better idea?
  • Reliable way to power on thinkpad using power stip alone: Probably erased RTC nvram + AC power is enough to power it on.
  • It has at least one more stage than necessary to avoid bricks that happen for completely unknown cause. This will aid bug reporting and reliability of the script in long run
  • Probably configure system for headless operation

Credits:

Very early WIP Warning: Unlike x60 method, this one yields bricks at any step being performed wrong. Therefore script has to perform all the checks to make sure it's safe to reboot. It will also make situation far worse for WSON8 users, lacking skills to replace the chip, when bricked. Prerequisite: * Pogo pin with resistor soldered/connected to an usb plug (GND)/mounted to vga pin screw (Size M?) * USI targets: conical tip pogo * Wistron targets: crown shaped pogo * Maybe we can stretch dupont jumper cable a bit to fit pogo without soldering? * Masking tape * Docking station/UltraBase * USB Keyboard for stage1 * Working Battery or UPS Steps * Power off machine and remove all power sources, main/ultrabay batteries included. * Remove keyboard/palmrest and locate GPIO33 testpoint according to libreboot and/or vendor documentation * (partially) remove mylar if necessary, if partially then use tape to stick it down so you can work in GPIO33 testpoint area. * Punch a hole in masking tape and stick on board so only gpio33 is exposed. It takes only a moment to mask off area to prevent accidental shorts. * Attach battery, and if you have a dock plug into the dock/ultrabase * Pull GPIO33 low using pogo pin and hold it * Attach power. If machine is not powering on use power button on * Remove pogo once started to boot your operating system * [Script] stage 1: * read dmidecode and confirm device is supported * probe flash with flashrom, check if probe is successful. Confirm IFD protection is disabled. * Dump flash and backup it. ($timestamp-stage0-backup.img) * Confirm that IFD size matches Flash part size * Check if bootblock matches anything known as rest of the image cannot be easily checked for sanity by just reading it. * Check whether IFD layout matches any known vendor one. * generate nogbe libreboot ifd for given flash size. * Check whether both battery/PSU brick are plugged in and in good order * flash generated ifd * Dump flash and confirm valid IFD for flash ($timestamp-stage1-backup.img) * In case of errors recommend user to flash $timestamp-stage0-backup.img, and report issues on IRC * Erase RTC NVRAM * Poweroff * Remove Power/batteries, assemble device back together, attach power/batteries again. * Power on device * [Script] stage 2 * Same checks as before but taking libreboot ifd into account * Check libreboot IFD being used and IFD restrictions being lifted * Generate IFD of following layout: ifd|bios|platform, where platform is covering bootblock and everything else is bios. * Generate Layout for flashing ifd and bios_rw (so vendor bios region minus bootblock) * Make sure that coreboot image fits into RW area of bios_rw area. * Flash ifd and coreboot into bios_rw area * flashrom -p internal -v image.img * Dump image ($timestamp-stage2-backup.img) * sync; sync; sync * Erase RTC NVRAM * This time yank out the power (both psu brick and battery) * We don't want flash contents to be mangled by vendor bios code * After couple of minutes reattach power and power it back on * [Script] stage 3 - finally on coreboot * Confirm all protections both IFD and PRx are gone * Confirm device from dmidecode and flash right image Notes: * Masking tape isn't transparent so probably kapton is a better idea? * Reliable way to power on thinkpad using power stip alone: Probably erased RTC nvram + AC power is enough to power it on. * It has at least one more stage than necessary to avoid bricks that happen for completely unknown cause. This will aid bug reporting and reliability of the script in long run * Probably configure system for headless operation Credits: * [GNUtoo](https://framagit.org/GNUtoo/coreboot-scripts/tree/fsf-wip) * ch1p_
zapper commented 1 month ago

Which device is this? aka, which thinkpad model?

Which device is this? aka, which thinkpad model?
ch1p commented 3 weeks ago

It's for X200/T400/T500. There also was a report on IRC of successful implementation (for internal coreboot flashing) on X201.

It's for X200/T400/T500. There also was a report on IRC of successful implementation (for internal coreboot flashing) on X201.
zapper commented 3 weeks ago

Hmm... I wonder if that means X201 will be librebooted soon... interesting. :o

Hmm... I wonder if that means X201 will be librebooted soon... interesting. :o
Sign in to join this conversation.
Loading...
Cancel
Save
There is no content yet.