Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support swap Fn and CtlL keys (how it should be) for the x200, middleton #32

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Support swap Fn and CtlL keys (how it should be) for the x200, middleton #32

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d8f06af
Support swap Fn and CtlL keys (how it should be) for the x200, middleton
ypid Jun 15, 2017
1abface
Split `make list_laptops` into `make list_laptops_all_versions`
ypid Jun 26, 2017
e738afd
Ensure the outer EC fw checksum is always fixed after patching
ypid Jun 26, 2017
ac64346
Use "tag file" for mec-tools build to avoid redundant makefile targets
ypid Jun 26, 2017
4e43dd5
Remove *.img.diff in `make clean`. Was missing before.
ypid Jun 26, 2017
93dacac
Document EC chip used in a x200
ypid Jun 29, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,9 @@

# ignore generated files
*.bat
*.diff
.d
.mec-tools_build_ok

# Temp are (should be) just junk
*.tmp
4 changes: 4 additions & 0 deletions Descriptions.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,10 @@

# The iso images downloadable from Lenovo
# (these checksums are those found on the Lenovo site)
6duj37uc.iso.orig 0ac15607379ac71ed041181ab1987b123cb2884d x200 and x200s BIOS 3.10 (7XET60WW) EC 1.04 (7XHT22WW)
6duj41uc.iso.orig 016b85296694340cc1b70c956e6fdd775b14d261 x200 and x200s BIOS 3.14 (7XET64WW) EC 1.06 (7XHT24WW)
6duj47uc.iso.orig 06a23e319e1028bd7b4ea8358b2335d5e2eb2e64 x200 and x200s BIOS 3.22 (7XET72WW) EC 1.06 (7XHT24WW)
6duj48us.iso.orig 461fe63039eb3849ff025d4bcb89b86a3607bf95 x200 and x200s BIOS 3.22 (7XET72WW) EC 1.07 (7XHT25WW)
8duj27us.iso.orig 856a1a3efee305d335df10932b54aa478f818677 x220 BIOS 1.42 (8DET72WW) EC 1.24 (8DHT34WW)
8muj19us.iso.orig ccbb450d9beaefa8b4c7e9ac559ae8503f8df5db x1, x1 hybrid BIOS 1.71 (8MET71WW) EC 2.02 (8MHT79WW)
g1uj25us.iso.orig 759e27829c13d591b097cbda2f34843265ef8813 t430 BIOS 2.57 (G1ET97WW) EC 1.12 (G1HT34WW)
Expand Down
74 changes: 60 additions & 14 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,20 @@ list_laptops:
$(info patched.x230.img - for patching Thinkpad X230)
$(info patched.x230t.img - for patching Thinkpad X230t)
$(info )
$(info patched.t430.257.img - for patching Thinkpad T430 BIOS 2.57 - no keyboard patch)
$(info patched.t430.257.112.img - for patching Thinkpad T430 BIOS 2.57/EC 1.12 - no keyboard patch)
$(info patched.x200.img - for patching Thinkpad x200 and x200s BIOS 3.22/EC 1.07 - only Fn Ctrl swap (ported middleton))
$(info )

.PHONY: list_laptops

list_laptops_all_versions: list_laptops
$(info Patches for older versions which might still be useful:)
$(info patched.x200.314.106.img - for patching Thinkpad x200 and x200s BIOS 3.14/EC 1.06 - only Fn Ctrl swap (middleton))
$(info patched.x200.322.106.img - for patching Thinkpad x200 and x200s BIOS 3.22/EC 1.06 - only Fn Ctrl swap (middleton))
$(info )

.PHONY: list_laptops_all_versions

DEPSDIR := .d
$(shell mkdir -p $(DEPSDIR))

Expand All @@ -41,8 +50,10 @@ clean:
rm -f $(CLEAN_FILES) \
patched.*.iso patched.*.img *.FL2 *.FL2.orig *.img.enc \
*.img.enc.orig *.img.orig *.bat \
*.img \
*.txt.orig
*.img *.img.diff \
*.txt.orig \
.mec-tools_build_ok
$(MAKE) -C mec-tools/ clean

# Also remove the large iso images downloaded from remote servers.
really_clean: clean
Expand All @@ -53,7 +64,7 @@ really_clean: clean
patched.t430.iso: g1uj40us.iso
$(call patched_iso,$<,$@)

patched.t430.257.iso: g1uj25us.iso
patched.t430.257.112.iso: g1uj25us.iso
$(call patched_iso,$<,$@)

patched.t430s.iso: g7uj19us.iso
Expand All @@ -68,6 +79,15 @@ patched.t530i.iso: g4uj30us.iso
patched.w530.iso: g5uj28us.iso
$(call patched_iso,$<,$@)

patched.x200.314.106.iso: 6duj41uc.iso
$(call patched_iso,$<,$@)

patched.x200.322.106.iso: 6duj47uc.iso
$(call patched_iso,$<,$@)

patched.x200.iso: 6duj48us.iso
$(call patched_iso,$<,$@)

patched.x230.iso: g2uj25us.iso
$(call patched_iso,$<,$@)

Expand Down Expand Up @@ -99,7 +119,7 @@ list_images:
# All the bios update iso images I have checked have had a fat16 filesystem
# embedded in a dos mbr image as the el-torito ISO payload. They also all
# had the same offset to this fat filesystem, so hardcode that offset here.
FAT_OFFSET := 71680
export FAT_OFFSET := 71680

# Some versions of mtools need this flag set to allow them to work with the
# dosfs images used by Lenovo - from my tests, it may be that Debian has
Expand All @@ -111,6 +131,8 @@ export MTOOLS_SKIP_CHECK=1
# so this target hacks around that
#
install.radare.projects:
mkdir -p ~/.config/radare2/projects/x200.7XHT24WW
cp -fs $(PWD)/radare/x200.7XHT24WW ~/.config/radare2/projects/x200.7XHT24WW/rc
mkdir -p ~/.config/radare2/projects/x220.8DHT34WW.d
cp -fs $(PWD)/radare/x220.8DHT34WW ~/.config/radare2/projects
mkdir -p ~/.config/radare2/projects/x230.G2HT35WW
Expand Down Expand Up @@ -141,6 +163,12 @@ patch_disable_keyboard:
$(call patch_disable,$$j); \
done

patch_enable_fn_ctrl_swap:
$(call patch_enable,008_fn_ctrl_swap.patch)

patch_disable_fn_ctrl_swap:
$(call patch_disable,008_fn_ctrl_swap.patch)

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This method for enabling and disabling patches has gotten unwieldy, especially since there are now multiple non-overlapping hardware types with different sets of patches.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

True. One the other hand, three patches are not that much either. If more get added then it should probably be optimized.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

agreed

# $1 is the old patch name
# $2 is the new patch name
define patch_mv
Expand Down Expand Up @@ -217,7 +245,7 @@ $(DEPSDIR)/slice.insert.deps: Makefile
# more barriers to downloading some random bios ISO and starting to port
# the code to it.
# FIXME - wrap the mec-tools with something that gives --rm_on_fail semantics
%.img.orig: %.img.enc.orig mec-tools/mec_encrypt
%.img.orig: %.img.enc.orig .mec-tools_build_ok
mec-tools/mec_encrypt -d $< $@
scripts/checksum --rm_on_fail $@
mec-tools/mec_csum_flasher -c $@
Expand All @@ -238,16 +266,23 @@ $(DEPSDIR)/slice.insert.deps: Makefile
.PRECIOUS: %.img.orig

# Generate a working file with any known patches applied
%.img: %.img.orig
%.img: %.img.orig .mec-tools_build_ok
cp --reflink=auto $< $@
./scripts/hexpatch.pl --rm_on_fail $@ $@.d/*.patch
./mec-tools/mec_csum_outer -f $@
./mec-tools/mec_csum_outer -c $@ || (rm $@; exit 1)

# using both __DIR and __FL2 is a hack to get around needing to quote the
# DOS path separator. It feels like there should be a better way if I put
# my mind to it..
#
%.iso.bat: %.iso.orig autoexec.bat.template
sed -e "s%__DIR%`mdir -/ -b -i $<@@$(FAT_OFFSET) |grep FL2 |cut -d/ -f3`%; s%__FL2%`mdir -/ -b -i $<@@$(FAT_OFFSET) |grep FL2 |cut -d/ -f4`%; s%__DESC%`scripts/describe $<`%; s/__BUILDINFO/$(BUILDINFO)/" autoexec.bat.template >$@.tmp
if echo '$@' | grep '^6duj4' -q; then \
cp --reflink=auto autoexec.bat.command_com.template $@.tmp; \
else \
cp --reflink=auto autoexec.bat.template $@.tmp; \
fi
sed -e "s%__DIR%`mdir -/ -b -i $<@@$(FAT_OFFSET) |grep FL2 |cut -d/ -f3 | head -n 1`%; s%__FL2%`mdir -/ -b -i $<@@$(FAT_OFFSET) |grep FL2 |cut -d/ -f4 | head -n 1`%; s%__DESC%`scripts/describe $<`%; s/__BUILDINFO/$(BUILDINFO)/" --in-place $@.tmp
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an ugly special case check. See also below where I talk about autoexec.bat.command_com.template

mv $@.tmp $@
touch -d @1 $@

Expand Down Expand Up @@ -317,38 +352,39 @@ endef
mec-tools/Makefile:
git submodule update --init --remote

mec-tools/mec_encrypt: mec-tools/Makefile
.mec-tools_build_ok: mec-tools/Makefile
git submodule update
make -C mec-tools
touch $@

# using function calls to build rules with actions is kind of a hack,
# which is why these are all on oneline.

# Insert the new firmware into the FL2 file
# $1 = encoded EC firmware
# $1 = repacked (csums fixed and optionally re-encrypted) EC firmware
# $2 = FL2 filename
define rule_fl2_patch
$(2): $(1) ; ./scripts/slice.insert $(1).slice $(1) $(2)
$(2): $(1) ./scripts/slice.insert ; ./scripts/slice.insert $(1).slice $(1) $(2)
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, technically this rule does depend on slice.insert, however changes to the slice.insert script (and similarly, the copyFL2 script below) should not change the contents of the resultant output.

(Conversely, there would not normally be any changes to these scripts, so no rebuilds would be triggered)

Can you expand a little on what your reasoning was?

Copy link
Contributor Author

@ypid ypid Jun 26, 2017 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"should not change the contents of the resultant output." True, but we can eliminate this last bit of uncertainty also by simply rerunning the script if it changed. Is that an issue?

I added this for "./scripts/slice.insert" as well when I was working on copyFL2 which output did change while working on it. Does that work for you?

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that works for me. I think I just dont like adding anything to those define lines - they are far too long. But I should just consider this as more reasons to try and rework those lines into something less ugly.

endef

# Create a new ISO image with patches applied
# $1 = FL2 filename
# $2 = ISO image
define rule_iso
$(2): $(1) $(2).bat ; cp --reflink=auto $(2).orig $(2) && ./scripts/copyFL2 to_iso $(2) $(1) && sed -i "s/__BUILT/`sha1sum $(1)`/" $(2).bat && mcopy -m -o -i $(2)@@$(FAT_OFFSET) $(2).bat ::AUTOEXEC.BAT && mdel -i $(2)@@$(FAT_OFFSET) ::EFI/Boot/BootX64.efi
$(2): $(1) $(2).bat ./scripts/copyFL2 ; cp --reflink=auto $(2).orig $(2) && ./scripts/copyFL2 to_iso $(2) $(1) && sed -i "s/__BUILT/`sha1sum $(1)`/" $(2).bat && mcopy -m -o -i $(2)@@$(FAT_OFFSET) $(2).bat ::AUTOEXEC.BAT && if mdir -/ -b -i $(2)@@71680 |grep BootX64.efi -q; then mdel -i $(2)@@$(FAT_OFFSET) ::EFI/Boot/BootX64.efi; fi
endef

# Extract the FL2 file from an ISO image
# Note that the parameters here are essentially the same as rule_iso, but you cannot
# define two targets with one define..
# $1 = FL2 filename basename
# $1 = FL2 file basename
# $2 = ISO image basename
#
# TODO - checking the checksum here is probably too strict - it adds
# more barriers to downloading some random bios ISO and starting to port
# the code to it.
define rule_fl2_extract
$(1).orig: $(2).orig ; ./scripts/copyFL2 from_iso $(2).orig $(1).orig && ./scripts/checksum --rm_on_fail $(2).orig
$(1).orig: $(2).orig ./scripts/copyFL2 ; ./scripts/copyFL2 from_iso $(2).orig $(1).orig && ./scripts/checksum --rm_on_fail $(2).orig
endef

#
Expand All @@ -363,11 +399,18 @@ $(call rule_fl2_patch,t430.G1HT35WW.img.enc,t430.G1HT35WW.s01D2000.FL2)
$(call rule_fl2_patch,t430s.G7HT39WW.img.enc,t430s.G7HT39WW.s01D8000.FL2)
$(call rule_fl2_patch,t530.G4HT39WW.img.enc,t530.G4HT39WW.s01D5100.FL2)
$(call rule_fl2_patch,w530.G4HT39WW.img.enc,w530.G4HT39WW.s01D5200.FL2)
$(call rule_fl2_patch,x200.7XHT22WW.img,x200.7XHT22WW.s01B9x00.FL2)
$(call rule_fl2_patch,x200.7XHT24WW.img,x200.7XHT24WW.s01B9x00.FL2)
$(call rule_fl2_patch,x200.7XHT25WW.img,x200.7XHT25WW.s01B9x00.FL2)
$(call rule_fl2_patch,x230.G2HT35WW.img.enc,x230.G2HT35WW.s01D3000.FL2)
$(call rule_fl2_patch,x230t.GCHT25WW.img.enc,x230t.GCHT25WW.s01DA000.FL2)

$(call rule_iso,t430.G1HT34WW.s01D2000.FL2,g1uj25us.iso)
$(call rule_iso,t430.G1HT35WW.s01D2000.FL2,g1uj40us.iso)
$(call rule_iso,x200.7XHT22WW.s01B9x00.FL2,6duj37uc.iso)
$(call rule_iso,x200.7XHT24WW.s01B9x00.FL2,6duj41uc.iso)
$(call rule_iso,x200.7XHT24WW.s01B9x00.FL2,6duj47uc.iso)
$(call rule_iso,x200.7XHT25WW.s01B9x00.FL2,6duj48us.iso)
$(call rule_iso,x230.G2HT35WW.s01D3000.FL2,g2uj25us.iso)
$(call rule_iso,t530.G4HT39WW.s01D5100.FL2,g4uj30us.iso)
$(call rule_iso,w530.G4HT39WW.s01D5200.FL2,g5uj28us.iso)
Expand All @@ -376,6 +419,9 @@ $(call rule_iso,x230t.GCHT25WW.s01DA000.FL2,gcuj24us.iso)

$(call rule_fl2_extract,t430.G1HT35WW.s01D2000.FL2,g1uj40us.iso)
$(call rule_fl2_extract,t430.G1HT34WW.s01D2000.FL2,g1uj25us.iso)
$(call rule_fl2_extract,x200.7XHT22WW.s01B9x00.FL2,6duj37uc.iso)
$(call rule_fl2_extract,x200.7XHT24WW.s01B9x00.FL2,6duj47uc.iso)
$(call rule_fl2_extract,x200.7XHT25WW.s01B9x00.FL2,6duj48us.iso)
$(call rule_fl2_extract,x230.G2HT35WW.s01D3000.FL2,g2uj25us.iso)
$(call rule_fl2_extract,t530.G4HT39WW.s01D5100.FL2,g4uj30us.iso)
$(call rule_fl2_extract,w530.G4HT39WW.s01D5200.FL2,g5uj28us.iso)
Expand Down
14 changes: 11 additions & 3 deletions README
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,10 @@
The main purpose of this software is to patch the EC on xx30 series thinkpads
to make the classic 7-row keyboards work. There are also patches included (but
disabled by default) to disable the authentic battery validation check.
to make the classic 7-row keyboards work. Furthermore, the following patches
are available for some thinkpad models:

* Turning off the authentic battery validation check.
The battery patches are disabled by default, but are easy to enable.
* Swap Fn and CtlL keys so that the physical layout becomes CtlL, Fn (how it should be).

With the patches included here, you can install the classic keyboard
hardware on many xx30 series laptops and make almost every key work properly.
Expand Down Expand Up @@ -43,7 +47,8 @@ will not complete.

4. Show the list of laptops and USB image file names:

make list_laptops
make list_laptops # Show only the most current supported BIOS and EC firmware.
make list_laptops_all_versions # Show all versions for which patches exist.

5. Choose your laptop model name from the list shown.
E.G. "patched.x230.img" for a x230 laptop.
Expand Down Expand Up @@ -107,3 +112,6 @@ of requirements.
including which laptop type it was built for. It pauses at this point
for you to confirm that you wish to proceed. It will then automatically
flash the patched firmware.

* Don’t touch the laptop until the update is done. Don’t plug in or
remove anything! It might brick the laptop!
24 changes: 24 additions & 0 deletions autoexec.bat.command_com.template
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
@ECHO OFF
PROMPT $p$g
cd c:\flash
cls
echo.
echo.
echo This will flash your EC firmware to support a classic 7-row keyboard (default)
echo or other modifications as configured at modification time.
echo.
echo.
echo WARNING: Incorrectly flashing your firmware can damage your laptop.
echo Ensure this is the right firmware version before attempting to flash
echo the firmware - there are minimal checks done.
echo.
echo This disc will flash the file __DIR\__FL2
echo.
echo This disk is prepared for __DESC
echo.
echo Buildinfo: __BUILDINFO
echo Built: __BUILT
echo.
pause
echo on
command.com
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you expand a little on what this is actually doing? Have Lenovo built a custom command.com? If so, what is interpreting this batch script?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a batch script but some binary blob which was invoked exactly the same by the original autoexec.bat. I simply copied last line from the original file.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking closer, it seems that /FLASH/COMMAND.COM is a compiled script which calls /FLASH/UPDTFLSH.EXE - another compiled script - which in turn calls FLASH/PHLASH16.EXE - and it looks like that one has some commandline options for specifying which files to flash.

I also wonder if the default flash scripts will allow you to re-flash a "same version" image - the xx30 tools certainly didnt, which is why zmatt worked out the dosflash commandline options.

Either way, to clean this up, it looks like some thought will be needed on how to make the autoexec bat generation better in the future.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also wonder if the default flash scripts will allow you to re-flash a "same version" image

This seems not to be an issue here. The EC firmware could just be downgraded with the patched.x200.314.106 image/flasher. I can confirm that this worked. I also tried to increase the version numbers but this was not reflected in the BIOS message. To be continued.

PHLASH16.EXE

This is worth a try, thanks!

3 changes: 2 additions & 1 deletion autoexec.bat.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,8 @@ cd c:\flash
cls
echo.
echo.
echo This will flash your firmware to support a classic 7-row keyboard
echo This will flash your EC firmware to support a classic 7-row keyboard (default)
echo or other modifications as configured at modification time.
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The build system should probably keep track of which patches are enabled and applied and insert that here, to be 100% clear and correct

echo.
echo.
echo WARNING: Incorrectly flashing your firmware can damage your laptop.
Expand Down
23 changes: 16 additions & 7 deletions docs/CONFIG.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,16 @@
Configuring which patches are used
----------------------------------

This repository has two sets of patches - one set for the keyboard
changes and one for turning off the battery validation. The battery
patches are disabled by default, but are easy to enable.
This repository has contains the following sets of patches for various ThinkPad models:

* Patch to use the classical IBM keyboard instead of the newer Lenovo chiclet keyboard.
* Turning off the authentic battery validation check.
The battery patches are disabled by default, but are easy to enable.
* Swap Fn and CtlL keys so that the physical layout becomes CtlL, Fn (how it should be).
For older Thinkpad models like the xx00 series the EC can not be configured
to swap Fn and Ctrl. This setting would usually be exposed in the BIOS setup
or in nvram when using coreboot.
Enabled by default for models where this can not be configured.
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Possibly need to make it clear which patches are available for which types of laptop


Any combination of the two sets of patches can be enabled or disabled
(even including a version with no patches at all - to revert all changes)
Expand All @@ -12,10 +19,12 @@ There are several makefile targets that exist to help you configure which
patches are enabled. Choose one or more of the following commands to
configure as you want:

make patch_enable_battery clean # Uses the battery validate patch
make patch_disable_battery clean # Turns off the battery validate patch
make patch_enable_keyboard clean # Uses the keyboard patches
make patch_disable_keyboard clean # Turns off the keyboard patches
make patch_enable_battery clean # Uses the battery validate patch
make patch_disable_battery clean # Turns off the battery validate patch
make patch_enable_keyboard clean # Uses the keyboard patches
make patch_disable_keyboard clean # Turns off the keyboard patches
make patch_enable_fn_ctrl_swap clean # Uses the Fn and CtlL key swap patch
make patch_disable_fn_ctrl_swap clean # Turns off the Fn and CtlL key swap patch

Behind the scenes
-----------------
Expand Down
2 changes: 1 addition & 1 deletion docs/HACKING.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ To use the radare projects, first install the project files:

Then ensure you have the image file(s):

make x220.8DHT34WW.img x230.G2HT35WW.img x260.R02HT29W.img
make x200.7XHT24WW.img x220.8DHT34WW.img x230.G2HT35WW.img x260.R02HT29W.img

Then start radare with one of these projects:

Expand Down
8 changes: 8 additions & 0 deletions docs/chips.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,14 @@ ThinkPad T4x/p and R5x/p:
Renesas H8S/2161BV
(source: http://forum.thinkpads.com/viewtopic.php?t=20958)

ThinkPad x200:
--------------
Renesas H8S/2116V
"F2116BG20V H8S/2116V" (physically printed on the chip)
"H8S/2116BG20V" (referred to by the Wistron Mocha-1 Block Diagram; 07226-1-Final; Project Code: 91.47Q01.001; PCB(Raw Card): 48.47Q01.001; dated 2008-05-08)

(source: physical inspection, reverse engineering the EC firmware and the schematics)

ThinkPad x220:
--------------
Renesas H8S R4F2113NFT-1-GP
Expand Down
5 changes: 3 additions & 2 deletions docs/firmware_layout.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,8 @@ These addresses have been seen to be stable in all the checked firmwares.

0x00000: Interrupt vector table
0x001ff: End of first encrypted region
0x00240: EC version string
0x00228: Two byte numeric EC version
0x00240: Alphanumeric EC version string
0x00268: Copyright notice string
0x00ff0: Start of second encrypted region
0x02048: List of 32-bit checksum results ("inner checksum")
Expand All @@ -52,7 +53,7 @@ These addresses have been seen to be stable in all the checked firmwares.

Notes:

* The x220 firmware starts the copyright string at 0x00264, which
* The x200 and x220 firmware starts the copyright string at 0x00264, which
might just be because the default variable size on the H8S is 16bits,
instead of the 32bit default on the ARC cpu - and that there are two
default-sized variables before this string.
Expand Down
7 changes: 7 additions & 0 deletions docs/x200.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
The flasher tool differs slightly for the tested versions:

* 6duj41uc.iso does allow downgrades.
* 6duj47uc.iso does not allow downgrades (BIOS version installed must be lower than 3.21).
* 6duj47uc.iso does not allow downgrades (BIOS version installed must be lower than 3.22).

Refer to https://libreboot.org/docs/hardware/x200.html for details.