[coreboot] GM45 ich9deblob and intel ME question

[Michal Widlok]

Hello,
I know that libreboot completely remove intel ME from old boards based
on GM45 chipset (like lenovo T400), and recently I found that it is
possible to neutralize it on newer chipsets also:
https://github.com/corna/me_cleaner
Since some of my T400 laptops still running on original BIOS (mostly
because of external video card and battery management with tp_smapi),
I was thinking if it is possible to use ich9deblob to remove intel ME
from original bios image. I have a special connector added to the
laptops so reading/writing flash images is quick and easy now.
The question is: Can I generate new descriptors with ich9deblob from
factory.rom (original bios image) and then add the descriptors with
"dd" to it just like to the libreboot image? Like:
flashrom -r factory.rom
ich9deblob
dd if=deblobbed_descriptor.bin of=factory.rom bs=1 count=12k conv=notrunc
flashrom -w factory.rom

Thanks in advance,
Michael Widlok

-- 
coreboot mailing list: coreboot@coreboot.org
https://mail.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Back to original BIOS

[Michal Widlok]

Hello Igor,

I've tried Yours procedure, but again no success. Anyway the bios
update was what make this board "unbootable" in the first place. I
think that I will just replace it with another one that is working
with original bios and with coreboot (again disassembly and soldering,
ufff).
Best Regards,
Michael Widlok

On Thu, Feb 9, 2017 at 2:11 PM, Igor Skochinsky <skochin...@mail.ru> wrote:
>
>
>
>>Четверг,  9 февраля 2017, 12:16 +01:00 от Michal Widlok 
>><michalwd1...@gmail.com>:
>>
>>Hello,
>>
>>Igor - I've checked it again. Mac is really at addresses 0x5F6000, 0x5F7000 - 
>>or my ghex editor does not work :-). The flash chip is 8MB (0x80), so 
>>fits right in. I will try Yours procedure, but I'm concerned about cutting 
>>image at 0x40 - are You talking about 4MB flash? All my laptops has 8MB.
>
> Ah, looks like you should use the files from the 7UET94WW directory, which 
> are 8MB for (unpacked) FL1 and 4MB for FL2 (you should use 20- 40 
> from it).
>
>>
>>Zoran - Michael is OK. In fact in polish Michal should end with special 
>>polish letter "ł", so I'm not sure if "international" Michael is not better 
>>anyway.
>>
>>Best Regards,
>>Michal Widlok
>>
>>
>>On Thu, Feb 9, 2017 at 9:50 AM, Zoran Stojsavljevic  < 
>>zoran.stojsavlje...@gmail.com > wrote:
>>>Hello Igor,
>>>
>>>Interesting emails. I should admit. For sure worth exploration, especially 
>>>GIT Hub application. :-)
>>>
>>>Michal (finally, I got your correct name, idiot me),
>>>
>>>I'll come back to this thread. I am last 3 days very busy. Very very busy, 
>>>but, certainly, I'll get free time, and will explore this opportunity, since 
>>>it makes my old, not so sharp anymore eyes very wide!
>>>
>>>Thank you all,
>>>Zoran
>>>
>>>On Wed, Feb 8, 2017 at 10:46 PM, Igor Skochinsky via coreboot  < 
>>>coreboot@coreboot.org > wrote:
>>>>P.S.
>>>>
>>>>
>>>>Hello Michal,
>>>>
>>>>The T400 BIOS is in a Pre-UEFI Phoenix FFV format. You can use 
>>>>phoenix_extract.py[1] to extract modules from it.
>>>>
>>>>To go back to Lenovo BIOS you can try the following:
>>>>
>>>>1) download an update from lenovo (e.g. 7uuj49us.exe)
>>>>2) unpack it with innounp
>>>>
>>>>2b) apparently innoextract [2] can be used on non-Windows platforms
>>>>
>>>>[2]:  http://constexpr.org/innoextract/
>>>>
>>>>
>>>>3a) take the FL2 file (e.g. $01B8100.FL2),  cut out from 0x20 to 
>>>>0x40 and use the resulting image to replace coreboot in the BIOS region 
>>>>(end of flash).
>>>>3b) take the FL1 file  (e.g. $01B8100.FL1), unpack it with bcpvd from [1] 
>>>>and flash the result (it's a complete flash image with descriptor and ME) 
>>>>after cutting it at 0x40
>>>>4) according to the descriptor in unpacked FL1 , the GbE region is at 
>>>>001F6000 - 001F7FFF, so that's the most likely place for storing the MAC 
>>>>address. I'm not sure why your desc.rom lists 5F6000 - 005F7FFF... I think 
>>>>that's outside the flash chip.
>>>>
>>>>[1]:  https://github.com/coreboot/bios_extract
>>>>
>>>>--
>>>>WBR,
>>>> Igor mailto:rox...@skynet.be
>>>>
>>>>
>>>>
>>>>--
>>>>WBR,
>>>> Igor mailto:skochin...@mail.ru
>>>>--
>>>>coreboot mailing list:  coreboot@coreboot.org
>>>>https://www.coreboot.org/mailman/listinfo/coreboot
>>>
>>
>>--
>>coreboot mailing list:  coreboot@coreboot.org
>>https://www.coreboot.org/mailman/listinfo/coreboot
>
> WBR, Igor
> mailto:skochin...@mail.ru

-- 
coreboot mailing list: coreboot@coreboot.org
https://www.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Back to original BIOS

[Michal Widlok]

Hello,

Igor - I've checked it again. Mac is really at addresses 0x5F6000, 0x5F7000
- or my ghex editor does not work :-). The flash chip is 8MB (0x80), so
fits right in. I will try Yours procedure, but I'm concerned about cutting
image at 0x40 - are You talking about 4MB flash? All my laptops has 8MB.
Zoran - Michael is OK. In fact in polish Michal should end with special
polish letter "ł", so I'm not sure if "international" Michael is not better
anyway.

Best Regards,
Michal Widlok


On Thu, Feb 9, 2017 at 9:50 AM, Zoran Stojsavljevic <
zoran.stojsavlje...@gmail.com> wrote:

> Hello Igor,
>
> Interesting emails. I should admit. For sure worth exploration, especially
> GIT Hub application. :-)
>
> Michal (finally, I got your correct name, idiot me),
>
> I'll come back to this thread. I am last 3 days very busy. Very very busy,
> but, certainly, I'll get free time, and will explore this opportunity,
> since it makes my old, not so sharp anymore eyes very wide!
>
> Thank you all,
> Zoran
>
> On Wed, Feb 8, 2017 at 10:46 PM, Igor Skochinsky via coreboot <
> coreboot@coreboot.org> wrote:
>
>> P.S.
>>
>>
>> Hello Michal,
>>
>> The T400 BIOS is in a Pre-UEFI Phoenix FFV format. You can use
>> phoenix_extract.py[1] to extract modules from it.
>>
>> To go back to Lenovo BIOS you can try the following:
>>
>> 1) download an update from lenovo (e.g. 7uuj49us.exe)
>> 2) unpack it with innounp
>>
>> 2b) apparently innoextract [2] can be used on non-Windows platforms
>>
>> [2]: http://constexpr.org/innoextract/
>>
>>
>> 3a) take the FL2 file (e.g. $01B8100.FL2),  cut out from 0x20 to
>> 0x40 and use the resulting image to replace coreboot in the BIOS region
>> (end of flash).
>> 3b) take the FL1 file  (e.g. $01B8100.FL1), unpack it with bcpvd from [1]
>> and flash the result (it's a complete flash image with descriptor and ME)
>> after cutting it at 0x40
>> 4) according to the descriptor in unpacked FL1 , the GbE region is at
>> 001F6000 - 001F7FFF, so that's the most likely place for storing the MAC
>> address. I'm not sure why your desc.rom lists 5F6000 - 005F7FFF... I think
>> that's outside the flash chip.
>>
>> [1]: https://github.com/coreboot/bios_extract
>>
>>
>>
>> *--  WBR,  Igormailto:rox...@skynet.be
>> <rox...@skynet.be>*
>>
>>
>>
>>
>>
>> *--  WBR,  Igormailto:skochin...@mail.ru
>> <skochin...@mail.ru>*
>>
>> --
>> coreboot mailing list: coreboot@coreboot.org
>> https://www.coreboot.org/mailman/listinfo/coreboot
>>
>
>
-- 
coreboot mailing list: coreboot@coreboot.org
https://www.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Back to original BIOS

[Michal Widlok]

m.
>
> But I am eager to hear/read what did you find investigating about T400
> structure, does it looks the same as T420, and et cetera. :-)
>
> You can also read descriptor region, and post it somewhere, so we can peek
> into it (I remember, I have somewhere some explanations about some of these
> descriptor region data).
>
> Thank you,
> Zoran
>
> On Sat, Feb 4, 2017 at 8:41 AM, Michal Widlok <michalwd1...@gmail.com>
> wrote:
>
>> Zoran, I'm working on this subject now, but I need to do regular work too
>> :-).
>>
>> Seriously I'm in the process of changing my current stationary
>> work-horse to two T400 laptops on docking stations. I've just received
>> docks (very dirty, noisy fans) and I borrowed my Raspberry programmer
>> to a friend. I hope to finish working on hardware this weekend and I
>> will be ready to play with bioses when I get Raspberry back. I think
>> that the first method would be to "copy" flash from one board to
>> another and we will see. I also try to change MAC in original bios,
>> maybe this is possible. I will report everything back, hope it will
>> help someone.
>> Michael Widlok
>>
>> PS. Sorry for double mail I messed addresses.
>>
>> On Fri, Feb 3, 2017 at 9:58 PM, Zoran Stojsavljevic
>> <zoran.stojsavlje...@gmail.com> wrote:
>> > Ron, I do agree, does not seem to be promising. It will add problems
>> down
>> > the road, as requirements grow.
>> >
>> > Zoran
>> >
>> > On Fri, Feb 3, 2017 at 8:45 PM, ron minnich <rminn...@gmail.com> wrote:
>> >>
>> >>
>> >>
>> >> On Fri, Feb 3, 2017 at 9:45 AM Zoran Stojsavljevic
>> >> <zoran.stojsavlje...@gmail.com> wrote:
>> >>>
>> >>>
>> >>>
>> >>> Ron, any (practical) example of above described practices? I have in
>> my
>> >>> laptops here 6 x 4 GB DIMM modules and 2 x 8GB DIMM modules, all of
>> them
>> >>> have SPD mounted.
>> >>
>> >>
>> >>
>> >> DIMMs are so great but so old school :-)
>> >>
>> >> on some systems, in flash, there are 4 and 8 element tables which are
>> >> indexed by GPIOs .You use the 2 or 3 bits from 2-3 GPIOs to index the
>> table
>> >> and that's how you get your RAM programming. No SPD. You can see how
>> much
>> >> room this leaves for problems.
>> >>
>> >> This is just one simple example.
>> >>
>> >> ron
>> >>
>> >
>> >
>>
>> --
>> coreboot mailing list: coreboot@coreboot.org
>> https://www.coreboot.org/mailman/listinfo/coreboot
>>
>
>
phnxsplit.exe by Ender

Found module at position 0x68858D.
Type A, number 03, block length 26653.
possible lzint compression (1, 6805).
pos 6849969 orig 26617 pack 26617
Ok.
Found module at position 0x68EDAA.
Type A, number 02, block length 354.
possible lzint compression (1, 14A).
pos 6876622 orig 318 pack 318
Ok.
Found module at position 0x68EF0C.
Type +, number 01, block length 34.
Unknown compression (54, 4E4C), lens 100, 25, A1F9. Just copying.
Found module at position 0x6B3000.
Type B, number 02, block length 46405.
lzint compression (C6, 8).
pos 7024684
Ok.
Found module at position 0x6BE545.
Type B, number 07, block length 6399.
lzint compression (C6, 8).
pos 7071089
Ok.
Found module at position 0x6BFE44.
Type L, number 02, block length 182.
possible lzint compression (1, 9E).
pos 7077480 orig 158 pack 158
Ok.
Found module at position 0x6BFEFA.
Type A, number 04, block length 107.
possible lzint compression (1, 53).
pos 7077662 orig 71 pack 71
Ok.
Found module at position 0x6C9000.
Type Q, number 00, block length 13902.
possible lzint compression (1, 3636).
pos 7114788 orig 13878 pack 13878
Ok.
Found module at position 0x6DC64E.
Type +, number 00, block length 10416.
possible lzint compression (1, 2898).
pos 7194226 orig 10392 pack 10392
Ok.
Found module at position 0x6EEEFE.
Type /, number 00, block length 24.
Unknown compression (EB, AA55), lens 6867, AB4, 7970. Just copying.
Found module at position 0x6FEF16.
Type ), number 00, block length 24.
Unknown compression (E9, AA55), lens 4E, 4000, 4943. Just copying.
Found module at position 0x70EF2E.
Type B, number 03, block length 43836.
lzint compression (C6, 8).
pos 7401306
Ok.
Found module at position 0x719A6A.
Type ,, number 00, block length 25476.
Unknown compression (60, 8B55), lens 9B16, 2E06, 9C. Just copying.
Found module at position 0x721D85.
Type B, number 00, block length 42037.
lzint compression (C6, 8).
pos 7478705
Ok.
Found module at position 0x72C1BA.
Type R, number 01, block length 4177

Re: [coreboot] Back to original BIOS

[Michal Widlok]

Zoran, I'm working on this subject now, but I need to do regular work too :-).

Seriously I'm in the process of changing my current stationary
work-horse to two T400 laptops on docking stations. I've just received
docks (very dirty, noisy fans) and I borrowed my Raspberry programmer
to a friend. I hope to finish working on hardware this weekend and I
will be ready to play with bioses when I get Raspberry back. I think
that the first method would be to "copy" flash from one board to
another and we will see. I also try to change MAC in original bios,
maybe this is possible. I will report everything back, hope it will
help someone.
Michael Widlok

PS. Sorry for double mail I messed addresses.

On Fri, Feb 3, 2017 at 9:58 PM, Zoran Stojsavljevic
 wrote:
> Ron, I do agree, does not seem to be promising. It will add problems down
> the road, as requirements grow.
>
> Zoran
>
> On Fri, Feb 3, 2017 at 8:45 PM, ron minnich  wrote:
>>
>>
>>
>> On Fri, Feb 3, 2017 at 9:45 AM Zoran Stojsavljevic
>>  wrote:
>>>
>>>
>>>
>>> Ron, any (practical) example of above described practices? I have in my
>>> laptops here 6 x 4 GB DIMM modules and 2 x 8GB DIMM modules, all of them
>>> have SPD mounted.
>>
>>
>>
>> DIMMs are so great but so old school :-)
>>
>> on some systems, in flash, there are 4 and 8 element tables which are
>> indexed by GPIOs .You use the 2 or 3 bits from 2-3 GPIOs to index the table
>> and that's how you get your RAM programming. No SPD. You can see how much
>> room this leaves for problems.
>>
>> This is just one simple example.
>>
>> ron
>>
>
>

-- 
coreboot mailing list: coreboot@coreboot.org
https://www.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Back to original BIOS

[Michal Widlok]

Hello, just a few observations from me, since a have a few T400
motherboards (in various states):
Once, before having raspberry "programmer" I've just exchange flash
chips between 2 motherboards, by de-soldering and re-soldering them -
it worked. There are also flash chips with original T400 bios on sale
- what about this? Lenovo is known for problems with bios updates
(check: "T400/T500 slow boot after bios update" in google), so I
suppose these chips might be useful. The problem that comes to my mind
is MAC address that is stored in flash - we know how to change it with
coreboot, but I'm not sure if on original bios also. If the MAC is
stored in the same place in coreboot and bios then it would be
possible to change it.

Peter: Is that really the case with old T400? The MAC might be a
problem, but what else? Maybe there are some things that I'm aware
off, and while motherboard looks ok in reality it is not.

Since all methods are rather complicated (and I don't have original
bios anyway), maybe the easiest would be to read flash chip with
original bios (from any unused mainboard) then just flash it to the
"right one", then follow with normal windows bios update - what do You
think?
Michael Widlok

-- 
coreboot mailing list: coreboot@coreboot.org
https://www.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] Back to original BIOS

[Michal Widlok]

Thank You for quick reply.
Ron - I've lost original bios, my mistake. I hoped nobody would ask
and spare me saying "I'm a moron" :-).
Zoran - This is TYPE 2767-2MG S/N R80DCTZ6 09/09. The one with
"switchable graphics" (Intel and Ati) onboard. Is any more info
required? Anyway since lenovo provides single update for every T400
model then it might not matter - or I am very wrong.

Michael Widlok

On Wed, Feb 1, 2017 at 9:20 PM, Zoran Stojsavljevic
<zoran.stojsavlje...@gmail.com> wrote:
> Hello Ron,
>
> No worries. I'll try to find the original BIOS for Michael, if Michael gives
> me exact model of Lenovo T400.
>
> Don't you agree? ;-)
>
> Zoran
>
> On Wed, Feb 1, 2017 at 8:41 PM, ron minnich <rminn...@gmail.com> wrote:
>>
>> did you save the bios before you flashed it?
>>
>> On Wed, Feb 1, 2017 at 11:11 AM Michal Widlok <michalwd1...@gmail.com>
>> wrote:
>>>
>>> Hello,
>>>
>>> Is it possible to flash back original BIOS from coreboot system on
>>> lenovo T400? I would like to play with tp_smapi module (battery checks
>>> at most). My board is already equipped with a connector from FLASH
>>> chip to Raspberry pi, so it can be hardware or software method.
>>>
>>> I've red about bios update from bootable CD or USB stick - will this
>>> method work with coreboot?
>>> Best Regards,
>>> Michael Widlok
>>>
>>> --
>>> coreboot mailing list: coreboot@coreboot.org
>>> https://www.coreboot.org/mailman/listinfo/coreboot
>>
>>
>> --
>> coreboot mailing list: coreboot@coreboot.org
>> https://www.coreboot.org/mailman/listinfo/coreboot
>
>

-- 
coreboot mailing list: coreboot@coreboot.org
https://www.coreboot.org/mailman/listinfo/coreboot

[coreboot] Back to original BIOS

[Michal Widlok]

Hello,

Is it possible to flash back original BIOS from coreboot system on
lenovo T400? I would like to play with tp_smapi module (battery checks
at most). My board is already equipped with a connector from FLASH
chip to Raspberry pi, so it can be hardware or software method.

I've red about bios update from bootable CD or USB stick - will this
method work with coreboot?
Best Regards,
Michael Widlok

-- 
coreboot mailing list: coreboot@coreboot.org
https://www.coreboot.org/mailman/listinfo/coreboot

[coreboot] Battery thresholds on lenovo T400

[Michal Widlok]

Dear Members,

I looking for a way to set battery charge thresholds on T400 with
coreboot. I know that tp_smapi are not supported, but I found an
interesting thread (it's for X220, but I hope that my would be
similar):
https://www.flashrom.org/pipermail/coreboot/2016-May/081460.html

The post says:
"tp smapi depends on lot of SMM/SMI code. So tp-smapi kernel module
asked the Lenovo BIOS to tell the EC to do something. coreboot don't
want to support SMM/SMI APIs, because they are quite dangerous.
But there is another way to get those features back.
We know how to enable it, but we haven't yet create a way to control
this by the user.

One thing could be a userspace tool executed as root or we add another
CMOS configuration for it. Any idea?"

Is that mean that EC in lenovo laptops is "known" enough to control
it, but coreboot is not ready to implement this functionality? An if
it is known the is there any literature/posts available that says how
to control it with ectool or something?

If there are any test needed to be done to help about this subject,
then I can do them on my laptop. Hardware flashing is possible also.
Very best regards,
Michael Widlok

-- 
coreboot mailing list: coreboot@coreboot.org
https://www.coreboot.org/mailman/listinfo/coreboot

Re: [coreboot] How coreboot cooperate with other bioses

[Michal Widlok]

Hello Ron,
If You have some spare time and can share some knowledge with me then
please let know, if not then that's OK. I would like to ask you some
questions about coreboot and dells (not about NDA of course).

Best Regards,
Michael W.


 I used NDA info from dell to enable flash writes. Which, obviously, I
 can not pass on.

 ron


--
coreboot mailing list: coreboot@coreboot.org
http://www.coreboot.org/mailman/listinfo/coreboot

[coreboot] Dell PE2850 with coreboot.

[Michal Widlok]

Hello,
I'm new to this lis and to coreboot, so please forgive me dumb
questions for a while :-). I would like to learn some more about it
and maybe install it on my Dell 2850. I've red then there is a WIP for
coreboot on dell 1850 - this one is similar to mine. Where can I get
some more information about this work? Is there any tutorial or other
info that explains how to install coreboot on dells?

Best Regards,
Michael W.

--
coreboot mailing list: coreboot@coreboot.org
http://www.coreboot.org/mailman/listinfo/coreboot