Support swap Fn and CtlL keys (how it should be) for the x200, middleton

For older Thinkpad models like the xx00 series the EC can not be configured
to swap Fn and Ctrl. This setting would usually be exposed in the BIOS setup
or in nvram when using coreboot.
Enabled by default for models where this can not be configured.

Updates: #4

.gitignore

@@ -12,6 +12,7 @@
 
 # ignore generated files
 *.bat
+*.diff
 .d
 
 # Temp are (should be) just junk

Descriptions.txt

@@ -14,6 +14,10 @@
 
 # The iso images downloadable from Lenovo
 # (these checksums are those found on the Lenovo site)
+6duj37uc.iso.orig  0ac15607379ac71ed041181ab1987b123cb2884d x200 and x200s BIOS 3.10 (7XET60WW) EC 1.04 (7XHT22WW)
+6duj41uc.iso.orig  016b85296694340cc1b70c956e6fdd775b14d261 x200 and x200s BIOS 3.14 (7XET64WW) EC 1.06 (7XHT24WW)
+6duj47uc.iso.orig  06a23e319e1028bd7b4ea8358b2335d5e2eb2e64 x200 and x200s BIOS 3.22 (7XET72WW) EC 1.06 (7XHT24WW)
+6duj48us.iso.orig  461fe63039eb3849ff025d4bcb89b86a3607bf95 x200 and x200s BIOS 3.22 (7XET72WW) EC 1.07 (7XHT25WW)
 8duj27us.iso.orig  856a1a3efee305d335df10932b54aa478f818677 x220 BIOS 1.42 (8DET72WW) EC 1.24 (8DHT34WW)
 8muj19us.iso.orig  ccbb450d9beaefa8b4c7e9ac559ae8503f8df5db x1, x1 hybrid BIOS 1.71 (8MET71WW) EC 2.02 (8MHT79WW)
 g1uj25us.iso.orig  759e27829c13d591b097cbda2f34843265ef8813 t430 BIOS 2.57 (G1ET97WW) EC 1.12 (G1HT34WW)

Makefile

@@ -27,7 +27,10 @@ list_laptops:
 	$(info patched.x230.img  - for patching Thinkpad X230)
 	$(info patched.x230t.img - for patching Thinkpad X230t)
 	$(info )
-	$(info patched.t430.257.img  - for patching Thinkpad T430 BIOS 2.57 - no keyboard patch)
+	$(info patched.t430.257.112.img - for patching Thinkpad T430 BIOS 2.57/EC 1.12 - no keyboard patch)
+	$(info patched.x200.314.106.img - for patching Thinkpad x200 and x200s BIOS 3.14/EC 1.06 - only Fn Ctrl swap (middleton))
+	$(info patched.x200.322.106.img - for patching Thinkpad x200 and x200s BIOS 3.22/EC 1.06 - only Fn Ctrl swap (middleton))
+	$(info patched.x200.img - for patching Thinkpad x200 and x200s BIOS 3.22/EC 1.07 - only Fn Ctrl swap (ported middleton))
 	$(info )
 
 .PHONY: list_laptops
@@ -39,8 +42,8 @@ $(shell mkdir -p $(DEPSDIR))
 # images) and any small downloads
 clean:
 	rm -f $(CLEAN_FILES) \
-            patched.*.iso patched.*.img *.FL2 *.FL2.orig *.img.enc \
-            *.img.enc.orig *.img.orig *.bat \
+            patched.*.iso patched.*.img *.FL2 *.FL2.orig *.img.enc *.img.csum_ok \
+            *.img.enc.orig *.img.csum_ok.orig *.img.orig *.bat \
             *.img \
             *.txt.orig
 
@@ -53,7 +56,7 @@ really_clean: clean
 patched.t430.iso: g1uj40us.iso
 	$(call patched_iso,$<,$@)
 
-patched.t430.257.iso: g1uj25us.iso
+patched.t430.257.112.iso: g1uj25us.iso
 	$(call patched_iso,$<,$@)
 
 patched.t430s.iso: g7uj19us.iso
@@ -68,6 +71,15 @@ patched.t530i.iso: g4uj30us.iso
 patched.w530.iso: g5uj28us.iso
 	$(call patched_iso,$<,$@)
 
+patched.x200.314.106.iso: 6duj41uc.iso
+	$(call patched_iso,$<,$@)
+
+patched.x200.322.106.iso: 6duj47uc.iso
+	$(call patched_iso,$<,$@)
+
+patched.x200.iso: 6duj48us.iso
+	$(call patched_iso,$<,$@)
+
 patched.x230.iso: g2uj25us.iso
 	$(call patched_iso,$<,$@)
 
@@ -99,7 +111,7 @@ list_images:
 # All the bios update iso images I have checked have had a fat16 filesystem
 # embedded in a dos mbr image as the el-torito ISO payload.  They also all
 # had the same offset to this fat filesystem, so hardcode that offset here.
-FAT_OFFSET := 71680
+export FAT_OFFSET := 71680
 
 # Some versions of mtools need this flag set to allow them to work with the
 # dosfs images used by Lenovo - from my tests, it may be that Debian has
@@ -111,6 +123,8 @@ export MTOOLS_SKIP_CHECK=1
 # so this target hacks around that
 #
 install.radare.projects:
+	mkdir -p ~/.config/radare2/projects/x200.7XHT24WW
+	cp -fs $(PWD)/radare/x200.7XHT24WW ~/.config/radare2/projects/x200.7XHT24WW/rc
 	mkdir -p ~/.config/radare2/projects/x220.8DHT34WW.d
 	cp -fs $(PWD)/radare/x220.8DHT34WW ~/.config/radare2/projects
 	mkdir -p ~/.config/radare2/projects/x230.G2HT35WW
@@ -141,6 +155,12 @@ patch_disable_keyboard:
 	 $(call patch_disable,$$j); \
 	done
 
+patch_enable_fn_ctrl_swap:
+	$(call patch_enable,008_fn_ctrl_swap.patch)
+
+patch_disable_fn_ctrl_swap:
+	$(call patch_disable,008_fn_ctrl_swap.patch)
+
 # $1 is the old patch name
 # $2 is the new patch name
 define patch_mv
@@ -228,6 +248,12 @@ $(DEPSDIR)/slice.insert.deps: Makefile
 %.img.enc:  %.img scripts/xx30.encrypt
 	./scripts/xx30.encrypt $< $@
 
+# A generic outer checksum fixer
+%.img.csum_ok: %.img mec-tools/mec_csum_outer
+	cp --reflink=auto $< $@
+	./mec-tools/mec_csum_outer -f $@
+	./mec-tools/mec_csum_outer -c $@
+
 # TODO
 # - if we ever get generic extraction or encryption for more than
 #   just the Xx30 series, these generic rules will need to be reworked
@@ -247,7 +273,12 @@ $(DEPSDIR)/slice.insert.deps: Makefile
 # my mind to it..
 #
 %.iso.bat: %.iso.orig autoexec.bat.template
-	sed -e "s%__DIR%`mdir -/ -b -i $<@@$(FAT_OFFSET) |grep FL2 |cut -d/ -f3`%; s%__FL2%`mdir -/ -b -i $<@@$(FAT_OFFSET) |grep FL2 |cut -d/ -f4`%; s%__DESC%`scripts/describe $<`%; s/__BUILDINFO/$(BUILDINFO)/" autoexec.bat.template >$@.tmp
+	if echo '$@' | grep '^6duj4' -q; then \
+	 cp --reflink=auto autoexec.bat.command_com.template $@.tmp; \
+	else \
+	 cp --reflink=auto autoexec.bat.template $@.tmp; \
+	fi
+	sed -e "s%__DIR%`mdir -/ -b -i $<@@$(FAT_OFFSET) |grep FL2 |cut -d/ -f3 | head -n 1`%; s%__FL2%`mdir -/ -b -i $<@@$(FAT_OFFSET) |grep FL2 |cut -d/ -f4 | head -n 1`%; s%__DESC%`scripts/describe $<`%; s/__BUILDINFO/$(BUILDINFO)/" --in-place $@.tmp
 	mv $@.tmp $@
 	touch -d @1 $@
 
@@ -321,34 +352,38 @@ mec-tools/mec_encrypt: mec-tools/Makefile
 	git submodule update
 	make -C mec-tools
 
+mec-tools/mec_csum_outer: mec-tools/Makefile
+	git submodule update
+	make -C mec-tools
+
 # using function calls to build rules with actions is kind of a hack,
 # which is why these are all on oneline.
 
 # Insert the new firmware into the FL2 file
-# $1 = encoded EC firmware
+# $1 = repacked (csums fixed and optionally re-encrypted) EC firmware
 # $2 = FL2 filename
 define rule_fl2_patch
-    $(2): $(1) ; ./scripts/slice.insert $(1).slice $(1) $(2)
+    $(2): $(1) ./scripts/slice.insert ; ./scripts/slice.insert $(1).slice $(1) $(2)
 endef
 
 # Create a new ISO image with patches applied
 # $1 = FL2 filename
 # $2 = ISO image
 define rule_iso
-    $(2): $(1) $(2).bat ; cp --reflink=auto $(2).orig $(2) && ./scripts/copyFL2 to_iso $(2) $(1) && sed -i "s/__BUILT/`sha1sum $(1)`/" $(2).bat && mcopy -m -o -i $(2)@@$(FAT_OFFSET) $(2).bat ::AUTOEXEC.BAT && mdel -i $(2)@@$(FAT_OFFSET) ::EFI/Boot/BootX64.efi
+    $(2): $(1) $(2).bat ./scripts/copyFL2 ; cp --reflink=auto $(2).orig $(2) && ./scripts/copyFL2 to_iso $(2) $(1) && sed -i "s/__BUILT/`sha1sum $(1)`/" $(2).bat && mcopy -m -o -i $(2)@@$(FAT_OFFSET) $(2).bat ::AUTOEXEC.BAT && if mdir -/ -b -i $(2)@@71680 |grep BootX64.efi -q; then mdel -i $(2)@@$(FAT_OFFSET) ::EFI/Boot/BootX64.efi; fi
 endef
 
 # Extract the FL2 file from an ISO image
 # Note that the parameters here are essentially the same as rule_iso, but you cannot
 # define two targets with one define..
-# $1 = FL2 filename basename
+# $1 = FL2 file basename
 # $2 = ISO image basename
 #
 # TODO - checking the checksum here is probably too strict - it adds
 # more barriers to downloading some random bios ISO and starting to port
 # the code to it.
 define rule_fl2_extract
-    $(1).orig: $(2).orig ; ./scripts/copyFL2 from_iso $(2).orig $(1).orig && ./scripts/checksum --rm_on_fail $(2).orig
+    $(1).orig: $(2).orig ./scripts/copyFL2 ; ./scripts/copyFL2 from_iso $(2).orig $(1).orig && ./scripts/checksum --rm_on_fail $(2).orig
 endef
 
 #
@@ -363,11 +398,18 @@ $(call rule_fl2_patch,t430.G1HT35WW.img.enc,t430.G1HT35WW.s01D2000.FL2)
 $(call rule_fl2_patch,t430s.G7HT39WW.img.enc,t430s.G7HT39WW.s01D8000.FL2)
 $(call rule_fl2_patch,t530.G4HT39WW.img.enc,t530.G4HT39WW.s01D5100.FL2)
 $(call rule_fl2_patch,w530.G4HT39WW.img.enc,w530.G4HT39WW.s01D5200.FL2)
+$(call rule_fl2_patch,x200.7XHT22WW.img.csum_ok,x200.7XHT22WW.s01B9x00.FL2)
+$(call rule_fl2_patch,x200.7XHT24WW.img.csum_ok,x200.7XHT24WW.s01B9x00.FL2)
+$(call rule_fl2_patch,x200.7XHT25WW.img.csum_ok,x200.7XHT25WW.s01B9x00.FL2)
 $(call rule_fl2_patch,x230.G2HT35WW.img.enc,x230.G2HT35WW.s01D3000.FL2)
 $(call rule_fl2_patch,x230t.GCHT25WW.img.enc,x230t.GCHT25WW.s01DA000.FL2)
 
 $(call rule_iso,t430.G1HT34WW.s01D2000.FL2,g1uj25us.iso)
 $(call rule_iso,t430.G1HT35WW.s01D2000.FL2,g1uj40us.iso)
+$(call rule_iso,x200.7XHT22WW.s01B9x00.FL2,6duj37uc.iso)
+$(call rule_iso,x200.7XHT24WW.s01B9x00.FL2,6duj41uc.iso)
+$(call rule_iso,x200.7XHT24WW.s01B9x00.FL2,6duj47uc.iso)
+$(call rule_iso,x200.7XHT25WW.s01B9x00.FL2,6duj48us.iso)
 $(call rule_iso,x230.G2HT35WW.s01D3000.FL2,g2uj25us.iso)
 $(call rule_iso,t530.G4HT39WW.s01D5100.FL2,g4uj30us.iso)
 $(call rule_iso,w530.G4HT39WW.s01D5200.FL2,g5uj28us.iso)
@@ -376,6 +418,9 @@ $(call rule_iso,x230t.GCHT25WW.s01DA000.FL2,gcuj24us.iso)
 
 $(call rule_fl2_extract,t430.G1HT35WW.s01D2000.FL2,g1uj40us.iso)
 $(call rule_fl2_extract,t430.G1HT34WW.s01D2000.FL2,g1uj25us.iso)
+$(call rule_fl2_extract,x200.7XHT22WW.s01B9x00.FL2,6duj37uc.iso)
+$(call rule_fl2_extract,x200.7XHT24WW.s01B9x00.FL2,6duj47uc.iso)
+$(call rule_fl2_extract,x200.7XHT25WW.s01B9x00.FL2,6duj48us.iso)
 $(call rule_fl2_extract,x230.G2HT35WW.s01D3000.FL2,g2uj25us.iso)
 $(call rule_fl2_extract,t530.G4HT39WW.s01D5100.FL2,g4uj30us.iso)
 $(call rule_fl2_extract,w530.G4HT39WW.s01D5200.FL2,g5uj28us.iso)

README

@@ -1,6 +1,10 @@
 The main purpose of this software is to patch the EC on xx30 series thinkpads
-to make the classic 7-row keyboards work.  There are also patches included (but
-disabled by default) to disable the authentic battery validation check.
+to make the classic 7-row keyboards work.  Furthermore, the following patches
+are available for some thinkpad models:
+
+* Turning off the authentic battery validation check.
+  The battery patches are disabled by default, but are easy to enable.
+* Swap Fn and CtlL keys so that the physical layout becomes CtlL, Fn (how it should be).
 
 With the patches included here, you can install the classic keyboard
 hardware on many xx30 series laptops and make almost every key work properly.

autoexec.bat.command_com.template

@@ -0,0 +1,24 @@
+@ECHO OFF
+PROMPT $p$g
+cd c:\flash
+cls
+echo.
+echo.
+echo This will flash your EC firmware to support a classic 7-row keyboard (default)
+echo or other modifications as configured at modification time.
+echo.
+echo.
+echo WARNING: Incorrectly flashing your firmware can damage your laptop.
+echo Ensure this is the right firmware version before attempting to flash
+echo the firmware - there are minimal checks done.
+echo.
+echo This disc will flash the file __DIR\__FL2
+echo.
+echo This disk is prepared for __DESC
+echo.
+echo Buildinfo: __BUILDINFO
+echo Built: __BUILT
+echo.
+pause
+echo on
+command.com

autoexec.bat.template

@@ -4,7 +4,8 @@ cd c:\flash
 cls
 echo.
 echo.
-echo This will flash your firmware to support a classic 7-row keyboard
+echo This will flash your EC firmware to support a classic 7-row keyboard (default)
+echo or other modifications as configured at modification time.
 echo.
 echo.
 echo WARNING: Incorrectly flashing your firmware can damage your laptop.

docs/CONFIG.txt

@@ -1,9 +1,16 @@
 Configuring which patches are used
 ----------------------------------
 
-This repository has two sets of patches - one set for the keyboard
-changes and one for turning off the battery validation.  The battery
-patches are disabled by default, but are easy to enable.
+This repository has contains the following sets of patches for various ThinkPad models:
+
+* Patch to use the classical IBM keyboard instead of the newer Lenovo chiclet keyboard.
+* Turning off the authentic battery validation check.
+  The battery patches are disabled by default, but are easy to enable.
+* Swap Fn and CtlL keys so that the physical layout becomes CtlL, Fn (how it should be).
+  For older Thinkpad models like the xx00 series the EC can not be configured
+  to swap Fn and Ctrl. This setting would usually be exposed in the BIOS setup
+  or in nvram when using coreboot.
+  Enabled by default for models where this can not be configured.
 
 Any combination of the two sets of patches can be enabled or disabled
 (even including a version with no patches at all - to revert all changes)
@@ -12,10 +19,12 @@ There are several makefile targets that exist to help you configure which
 patches are enabled.  Choose one or more of the following commands to
 configure as you want:
 
-    make patch_enable_battery clean     # Uses the battery validate patch
-    make patch_disable_battery clean    # Turns off the battery validate patch
-    make patch_enable_keyboard clean    # Uses the keyboard patches
-    make patch_disable_keyboard clean   # Turns off the keyboard patches
+    make patch_enable_battery clean       # Uses the battery validate patch
+    make patch_disable_battery clean      # Turns off the battery validate patch
+    make patch_enable_keyboard clean      # Uses the keyboard patches
+    make patch_disable_keyboard clean     # Turns off the keyboard patches
+    make patch_enable_fn_ctrl_swap clean  # Uses the Fn and CtlL key swap patch
+    make patch_disable_fn_ctrl_swap clean # Turns off the Fn and CtlL key swap patch
 
 Behind the scenes
 -----------------

docs/HACKING.txt

@@ -15,7 +15,7 @@ To use the radare projects, first install the project files:
 
 Then ensure you have the image file(s):
 
-    make x220.8DHT34WW.img x230.G2HT35WW.img x260.R02HT29W.img
+    make x200.7XHT24WW.img x220.8DHT34WW.img x230.G2HT35WW.img x260.R02HT29W.img
 
 Then start radare with one of these projects:
 

docs/firmware_layout.txt

@@ -42,7 +42,8 @@ These addresses have been seen to be stable in all the checked firmwares.
 
 0x00000:        Interrupt vector table
 0x001ff:        End of first encrypted region
-0x00240:        EC version string
+0x00228:        Two byte numeric EC version
+0x00240:        Alphanumeric EC version string
 0x00268:        Copyright notice string
 0x00ff0:        Start of second encrypted region
 0x02048:        List of 32-bit checksum results ("inner checksum")
@@ -52,7 +53,7 @@ These addresses have been seen to be stable in all the checked firmwares.
 
 Notes:
 
-* The x220 firmware starts the copyright string at 0x00264, which
+* The x200 and x220 firmware starts the copyright string at 0x00264, which
   might just be because the default variable size on the H8S is 16bits,
   instead of the 32bit default on the ARC cpu - and that there are two
   default-sized variables before this string.

docs/x200.txt

@@ -0,0 +1,11 @@
+The flasher tool differs slightly for the tested versions:
+
+* 6duj41uc.iso does allow downgrades.
+* 6duj47uc.iso does not allow downgrades (BIOS version installed must be lower than 3.21).
+* 6duj47uc.iso does not allow downgrades (BIOS version installed must be lower than 3.22).
+
+Don’t touch the laptop until the update is done. Don’t plug in anything or remove anything! It might brick the laptop. Don’t ask how I know ;-)
+
+You might need to start with patched.x200.314.106 because patched.x200.322.106 does not allow to downgrade a newer BIOS to an older one.
+
+Refer to https://libreboot.org/docs/hardware/x200.html for details.