code:
% Macbook 2,1

There is an Apple laptop called the macbook2,1 from late 2006 or early
2007 that uses the same i945 chipset as the ThinkPad X60 and ThinkPad
T60. A developer ported coreboot to their macbook2,1, and now libreboot
can run on it.

Mono Moosbart is the person who wrote the port for macbook2,1.
Referenced below are copies (up to date at the time of writing,
20140630) of the pages that this person wrote when porting coreboot to
the macbook2,1. They are included here in case the main site goes down
for whatever reason, since they include a lot of useful information.

Backups created using wget:

    $ wget -m -p -E -k -K -np http://macbook.donderklumpen.de/
**\$ wget -m -p -E -k -K -np
http://macbook.donderklumpen.de/coreboot/**\
Use **-e robots=off** if using this trick for other sites and the site
restricts using robots.txt

**Links to wget backups (and the backups themselves) of Mono's pages
(see above) removed temporarily. Mono has given me permission to
distribute them, but I need to ask this person to tell me what license
these works fall under first. Otherwise, the above URLs should be fine.
NOTE TO SELF: REMOVE THIS WHEN DONE**

### Installing GNU+Linux distributions (on Apple EFI firmware)

-   [Parabola GNU+Linux installation on a macbook2,1 with Apple EFI
    firmware](#) (this is a copy of Mono's page, see above)

How to boot an ISO: burn it to a CD (like you would normally) and hold
down the Alt/Control key while booting. The bootloader will detect the
GNU+Linux CD as 'Windows' (because Apple doesn't think GNU+Linux
exists). Install it like you normally would. When you boot up again,
hold Alt/Control once more. The installation (on the HDD) will once
again be seen as 'Windows'. (it's not actually Windows, but Apple
likes to think that Apple and Microsoft are all that exist.) Now to
install libreboot, follow
[../install/\#flashrom\_macbook21](../install/#flashrom_macbook21).

### Information about coreboot

-   [Coreboot on the macbook2,1](#) (this is a copy of Mono's page, see
    above)

### coreboot wiki page

-   <https://www.coreboot.org/Board:apple/macbook21>

### Compatible models

It is believed that all models are compatible, listed here:

-   <http://www.everymac.com/ultimate-mac-lookup/?search_keywords=MacBook2,1>

Specifically (Order No. / Model No. / CPU):

-   MA699LL/A / A1181 (EMC 2121) / Intel Core 2 Duo T5600 **(tested -
    working)**
-   MA701LL/A / A1181 (EMC 2121) / Intel Core 2 Duo T7200 **(tested -
    working)**
-   MB061LL/A / A1181 (EMC 2139) / Intel Core 2 Duo T7200 (untested)
-   MA700LL/A / A1181 (EMC 2121) / Intel Core 2 Duo T7200 **(tested -
    working)**
-   MB063LL/A / A1181 (EMC 2139) / Intel Core 2 Duo T7400 (works)
-   MB062LL/A / A1181 (EMC 2139) / Intel Core 2 Duo T7400 **(tested -
    working)**

Also of interest:
[../git/\#config\_macbook21](../git/#config_macbook21).

Unbricking: [this page shows disassembly
guides](https://www.ifixit.com/Device/MacBook_Core_2_Duo) and mono's
page (see above) shows the location of the SPI flash chip on the
motherboard. [How to remove the
motherboard](https://www.ifixit.com/Guide/MacBook+Core+2+Duo+PRAM+Battery+Replacement/529).

For external flashing, refer to
[../install/bbb\_setup.html](../install/bbb_setup.html).

You need to replace OS X with GNU+Linux before flashing libreboot. (OSX
won't run at all in libreboot).

There are some issues with this system (compared to other computers that
libreboot supports):

This is an apple laptop, so it comes with OS X: it has an Apple
keyboard, which means that certain keys are missing: insert, del, home,
end, pgup, pgdown. There is also one mouse button only. Battery life is
poor compared to X60/T60 (for now). It also has other issues: for
example, the Apple logo on the back is a hole, exposing the backlight,
which means that it glows. You should cover it up.

The system does get a bit hotter compared to when running the original
firmware. It is certainly hotter than an X60/T60. The heat issues have
been partially fixed by the following patch (now merged in libreboot):
<https://review.coreboot.org/#/c/7923/>.

**The MacBook2,1 comes with a webcam, which does not work without
proprietary software. Also, webcams are a security risk; cover it up! Or
remove it.**

A user reported that they could get better response from the touchpad
with the following in their xorg.conf:

    Section "InputClass"
     Identifier "Synaptics Touchpad"
     Driver "synaptics"
     MatchIsTouchpad "on"
     MatchDevicePath "/dev/input/event*"
     Driver "synaptics"
    # The next two values determine how much pressure one needs
    # for tapping, moving the cursor and other events.
     Option "FingerLow" "10"
     Option "FingerHigh" "15"
    # Do not emulate mouse buttons in the touchpad corners.
     Option "RTCornerButton" "0"
     Option "RBCornerButton" "0"
     Option "LTCornerButton" "0"
     Option "LBCornerButton" "0"
    # One finger tap = left-click
     Option "TapButton1" "1"
    # Two fingers tap = right-click
     Option "TapButton2" "3"
    # Three fingers tap = middle-mouse
     Option "TapButton3" "2"
    # Try to not count the palm of the hand landing on the touchpad
    # as a tap. Not sure if helps.
     Option "PalmDetect" "1"
    # The following modifies how long and how fast scrolling continues
    # after lifting the finger when scrolling
     Option "CoastingSpeed" "20"
     Option "CoastingFriction" "200"
    # Smaller number means that the finger has to travel less distance
    # for it to count as cursor movement. Larger number prevents cursor
    # shaking.
     Option "HorizHysteresis" "10"
     Option "VertHysteresis" "10"
    # Prevent two-finger scrolling. Very jerky movement
     Option "HorizTwoFingerScroll" "0"
     Option "VertTwoFingerScroll" "0"
    # Use edge scrolling
     Option "HorizEdgeScroll" "1"
     Option "VertEdgeScroll" "1"
    EndSection

A user reported that the above is only for linux kernel 3.15 or lower.
For newer kernels, the touchpad works fine out of the box, except middle
tapping.

A user submitted a utility to enable 3-finger tap on this laptop. It's
available at *resources/utilities/macbook21-three-finger-tap* in the
libreboot git repository.


code:
% ThinkPad R400

It is believed that all or most R400 laptops are compatible. See notes
about [CPU
compatibility](../install/r400_external.html#cpu_compatibility) for
potential incompatibilities.

There are two possible flash chip sizes for the R400: 4MiB (32Mbit) or
8MiB (64Mbit). This can be identified by the type of flash chip below
the palmrest: 4MiB is SOIC-8, 8MiB is SOIC-16.

**The R400 laptops come with the ME (and sometimes AMT in addition)
before flashing libreboot. Libreboot disables and removes it by using a
modified descriptor: see [gm45\_remove\_me.html](gm45_remove_me.html)**
(contains notes, plus instructions)

Flashing instructions can be found at
[../install/\#flashrom](../install/#flashrom)

EC update {#ecupdate}
=========

It is recommended that you update to the latest EC firmware version. The
[EC firmware](https://libreboot.org/faq/#firmware-ec) is separate from
libreboot, so we don't actually provide that, but if you still have
Lenovo BIOS then you can just run the Lenovo BIOS update utility, which
will update both the BIOS and EC version. See:

-   <https://libreboot.org/docs/install/index.html#flashrom>
-   <http://www.thinkwiki.org/wiki/BIOS_update_without_optical_disk>

NOTE: this can only be done when you are using Lenovo BIOS. How to
update the EC firmware while running libreboot is unknown. Libreboot
only replaces the BIOS firmware, not EC.

Updated EC firmware has several advantages e.g. bettery battery
handling.

Compatibility (without blobs) {#compatibility_noblobs}
-----------------------------

### Hardware virtualization (vt-x) {#hwvirt}

The R400, when run without CPU microcode updates in coreboot, currently
kernel panics if running QEMU with vt-x enabled on 2 cores for the
guest. With a single core enabled for the guest, the guest panics (but
the host is fine). Working around this in QEMU might be possible; if
not, software virtualization should work fine (it's just slower).

On GM45 hardware (with libreboot), make sure that the *kvm* and
*kvm\_intel* kernel modules are not loaded, when using QEMU.

The following errata datasheet from Intel might help with investigation:
<http://download.intel.com/design/mobile/specupdt/320121.pdf>

The R400 is almost identical to the X200, code-wise. See
[x200.html](x200.html).

TODO: put hardware register logs here like on the [X200](x200.html) and
[T400](t400.html) page.

Copyright © 2014, 2015 Leah Rowe <info@minifree.org>\
This page is available under the [CC BY SA 4.0](../cc-by-sa-4.0.txt)
% Flashing the R400 with a BeagleBone Black

Initial flashing instructions for R400.

This guide is for those who want libreboot on their ThinkPad R400 while
they still have the original Lenovo BIOS present. This guide can also be
followed (adapted) if you brick your R400, to know how to recover.

Before following this section, please make sure to setup your libreboot
ROM properly first. Although ROM images are provided pre-built in
libreboot, there are some modifications that you need to make to the one
you chose before flashing. (instructions referenced later in this guide)

Libreboot T400 {#t400}
==============

You may also be interested in the smaller, more portable [Libreboot
T400](t400_external.html).

Serial port {#serial_port}
-----------

EHCI debug might not be needed. It has been reported that the docking
station for this laptop has a serial port, so it might be possible to
use that instead.

A note about CPUs
=================

[ThinkWiki](http://www.thinkwiki.org/wiki/Category:R400) has a list of
CPUs for this system. The Core 2 Duo P8400 and P8600 are believed to
work in libreboot. The Core 2 Duo T9600 was confirmed to work, so the
T9400 probably also works. **The Core 2 Duo T5870/5670 and Celeron M
575/585 are untested!**

Quad-core CPUs
--------------

Incompatible. Do not use.

A note about GPUs
=================

Some models have an Intel GPU, while others have both an ATI and an
Intel GPU; this is referred to as "switchable graphics". In the *BIOS
setup* program for lenovobios, you can specify that the system will use
one or the other (but not both).

Libreboot is known to work on systems with only the Intel GPU, using
native graphics initialization. On systems with switchable graphics, the
Intel GPU is used and the ATI GPU is disabled, so native graphics
initialization works all the same.

CPU paste required
==================

See [\#paste](#paste).

Flash chip size {#flashchips}
===============

Use this to find out:
    # flashrom -p internal -V

MAC address {#macaddress}
===========

On the R400, the MAC address for the onboard gigabit ethernet chipset is
stored inside the flash chip, along with other configuration data.

Keep a note of the MAC address before disassembly; this is very
important, because you will need to insert this into the libreboot ROM
image before flashing it. It will be written in one of these locations:

![](images/t400/macaddress0.jpg) ![](images/t400/macaddress1.jpg)
![](images/x200/disassembly/0001.jpg)

Initial BBB configuration
=========================

Refer to [bbb\_setup.html](bbb_setup.html) for how to setup the BBB for
flashing.

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-16 (clip: Pomona 5252):

    POMONA 5252 (correlate with the BBB guide)
    ===  ethernet jack and VGA port ====
     NC              -       - 21
     1               -       - 17
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     18              -       - 3.3V (PSU)
     22              -       - NC - this is pin 1 on the flash chip
    ===  SATA port ===
    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-8 (clip: Pomona 5250):

    POMONA 5250 (correlate with the BBB guide)
    ===  RAM slots ====
     18              -       - 1
     22              -       - NC
     NC              -       - 21
     3.3V (PSU)      -       - 17 - this is pin 1 on the flash chip
    ===  slot where the AC jack is connected ===
    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

Disassembly
-----------

Remove all screws:\
![](images/r400/0000.jpg)\
Remove the HDD and optical drive:\
![](images/r400/0001.jpg)\
Remove the hinge screws:\
![](images/r400/0002.jpg) ![](images/r400/0003.jpg)

Remove the palm rest and keyboard:\
![](images/r400/0004.jpg) ![](images/r400/0005.jpg)

Remove these screws, and then remove the bezel:\
![](images/r400/0006.jpg) ![](images/r400/0007.jpg)

Remove the speaker screws, but don't remove the speakers yet (just set
them loose):\
![](images/r400/0008.jpg) ![](images/r400/0009.jpg)
![](images/r400/0010.jpg)

Remove these screws, and then remove the metal plate:\
![](images/r400/0011.jpg) ![](images/r400/0012.jpg)
![](images/r400/0013.jpg)

Remove the antennas from the wifi card, and then start unrouting them:\
![](images/r400/0014.jpg) ![](images/r400/0015.jpg)
![](images/r400/0016.jpg) ![](images/r400/0017.jpg)
![](images/r400/0018.jpg) ![](images/r400/0019.jpg)

Disconnect the LCD cable from the motherboard:\
![](images/r400/0020.jpg) ![](images/r400/0021.jpg)
![](images/r400/0022.jpg) ![](images/r400/0023.jpg)

Remove the hinge screws, and then remove the LCD panel:\
![](images/r400/0024.jpg) ![](images/r400/0025.jpg)
![](images/r400/0026.jpg) ![](images/r400/0027.jpg)

Remove this:\
![](images/r400/0028.jpg) ![](images/r400/0029.jpg)

Remove this long cable (there are 3 connections):\
![](images/r400/0030.jpg) ![](images/r400/0031.jpg)
![](images/r400/0032.jpg) ![](images/r400/0033.jpg)

Disconnect the speaker cable, and remove the speakers:\
![](images/r400/0034.jpg)

Remove the heatsink screws, remove the fan and then remove the
heatsink/fan:\
![](images/r400/0035.jpg) ![](images/r400/0036.jpg)
![](images/r400/0037.jpg) ![](images/r400/0038.jpg)

Remove the NVRAM battery:\
![](images/r400/0039.jpg) ![](images/r400/0040.jpg)

Remove this screw:\
![](images/r400/0041.jpg) ![](images/r400/0042.jpg)

Disconnect the AC jack:\
![](images/r400/0043.jpg) ![](images/r400/0044.jpg)

Remove this screw and then remove what is under it:\
![](images/r400/0045.jpg)

Remove this:\
![](images/r400/0046.jpg)

Lift the motherboard (which is still inside the cage) from the side on
the right, removing it completely:\
![](images/r400/0047.jpg) ![](images/r400/0048.jpg)

Remove all screws, marking each hole so that you know where to re-insert
them. You should place the screws in a layout corresponding to the order
that they were in before removal: ![](images/r400/0049.jpg)
![](images/r400/0050.jpg)

Remove the motherboard from the cage, and the SPI flash chip will be
next to the memory slots:\
![](images/r400/0051.jpg) ![](images/r400/0052.jpg)

Connect your programmer, then connect GND and 3.3V\
![](images/t400/0065.jpg) ![](images/t400/0066.jpg)
![](images/t400/0067.jpg) ![](images/t400/0069.jpg)
![](images/t400/0070.jpg) ![](images/t400/0071.jpg)

A dedicated 3.3V PSU was used to create this guide, but at ATX PSU is
also fine:\
![](images/t400/0072.jpg)

Of course, make sure to turn on your PSU:\
![](images/x200/disassembly/0013.jpg)

Now, you should be ready to install libreboot.

Flashrom binaries for ARM (tested on a BBB) are distributed in
libreboot\_util. Alternatively, libreboot also distributes flashrom
source code which can be built.

Log in as root on your BBB, using the instructions in
[bbb\_setup.html\#bbb\_access](bbb_setup.html#bbb_access).

Test that flashrom works:
    # ./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512\
In this case, the output was:

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6406E/MX25L6436E" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6445E/MX25L6473E" (8192 kB, SPI) on linux_spi.
    Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)", "MX25L6406E/MX25L6436E", "MX25L6445E/MX25L6473E"
    Please specify which chip definition to use with the -c <chipname> option.

How to backup factory.rom (change the -c option as neeed, for your flash
chip):\
\# **./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512 -r
factory.rom**\
\# **./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512 -r
factory1.rom**\
\# **./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512 -r
factory2.rom**\
Note: the **-c** option is not required in libreboot's patched
flashrom, because the redundant flash chip definitions in *flashchips.c*
have been removed.\
Now compare the 3 images:

    # sha512sum factory\*.rom
If the hashes match, then just copy one of them (the factory.rom) to a
safe place (on a drive connected to another system, not the BBB). This
is useful for reverse engineering work, if there is a desirable
behaviour in the original firmware that could be replicated in coreboot
and libreboot.

Follow the instructions at
[../hcl/gm45\_remove\_me.html\#ich9gen](../hcl/gm45_remove_me.html#ich9gen)
to change the MAC address inside the libreboot ROM image, before
flashing it. Although there is a default MAC address inside the ROM
image, this is not what you want. **Make sure to always change the MAC
address to one that is correct for your system.**

Now flash it:\
\# **./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512 -w
path/to/libreboot/rom/image.rom -V**

![](images/x200/disassembly/0015.jpg)

You might see errors, but if it says **Verifying flash\... VERIFIED** at
the end, then it's flashed and should boot. If you see errors, try
again (and again, and again); the message **Chip content is identical to
the requested image** is also an indication of a successful
installation.

Example output from running the command (see above):

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Reading old flash chip contents... done.
    Erasing and writing flash chip... FAILED at 0x00001000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x0000ffff: 0xd716
    ERASE FAILED!
    Reading current flash chip contents... done. Looking for another erase function.
    Erase/write done.
    Verifying flash... VERIFIED.

Thermal paste (IMPORTANT)
=========================

Because part of this procedure involved removing the heatsink, you will
need to apply new paste. Arctic MX-4 is ok. You will also need isopropyl
alcohol and an anti-static cloth to clean with.

When re-installing the heatsink, you must first clean off all old paste
with the alcohol/cloth. Then apply new paste. Arctic MX-4 is also much
better than the default paste used on these systems.

![](images/t400/paste.jpg)

NOTE: the photo above is for illustration purposes only, and does not
show how to properly apply the thermal paste. Other guides online detail
the proper application procedure.

Wifi
====

The R400 typically comes with an Intel wifi chipset, which does not work
without proprietary software. For a list of wifi chipsets that work
without proprietary software, see
[../hcl/\#recommended\_wifi](../hcl/#recommended_wifi).

Some R400 laptops might come with an Atheros chipset, but this is
802.11g only.

It is recommended that you install a new wifi chipset. This can only be
done after installing libreboot, because the original firmware has a
whitelist of approved chips, and it will refuse to boot if you use an
'unauthorized' wifi card.

The following photos show an Atheros AR5B95 being installed, to replace
the Intel chip that this R400 came with:\
![](images/t400/0012.jpg) ![](images/t400/ar5b95.jpg)

WWAN
====

If you have a WWAN/3G card and/or sim card reader, remove them
permanently. The WWAN-3G card has proprietary firmware inside; the
technology is identical to what is used in mobile phones, so it can also
track your movements.

Not to be confused with wifi (wifi is fine).

Memory
======

You need DDR3 SODIMM PC3-8500 RAM installed, in matching pairs
(speed/size). Non-matching pairs won't work. You can also install a
single module (meaning, one of the slots will be empty) in slot 0.

Make sure that the RAM you buy is the 2Rx8 density.

[This page](http://www.forum.thinkpads.com/viewtopic.php?p=760721) might
be useful for RAM compatibility info (note: coreboot raminit is
different, so this page might be BS)

The following photo shows 8GiB (2x4GiB) of RAM installed:\
![](images/t400/memory.jpg)

Boot it!
--------

You should see something like this:

![](images/t400/boot0.jpg) ![](images/t400/boot1.jpg)

Now [install GNU+Linux](../gnulinux/).

Copyright © 2014, 2015 Leah Rowe <info@minifree.org>\
This page is available under the [CC BY SA 4.0](../cc-by-sa-4.0.txt)

license: mit


code:
% ThinkPad T400

It is believed that all or most T400 laptops are compatible. See notes
about [CPU
compatibility](../install/t400_external.html#cpu_compatibility) for
potential incompatibilities.

There are two possible flash chip sizes for the T400: 4MiB (32Mbit) or
8MiB (64Mbit). This can be identified by the type of flash chip below
the palmrest: 4MiB is SOIC-8, 8MiB is SOIC-16.

**The T400 laptops come with the ME (and sometimes AMT in addition)
before flashing libreboot. Libreboot disables and removes it by using a
modified descriptor: see [gm45\_remove\_me.html](gm45_remove_me.html)**
(contains notes, plus instructions)

Flashing instructions can be found at
[../install/\#flashrom](../install/#flashrom)

EC update {#ecupdate}
=========

It is recommended that you update to the latest EC firmware version. The
[EC firmware](https://libreboot.org/faq/#firmware-ec) is separate from
libreboot, so we don't actually provide that, but if you still have
Lenovo BIOS then you can just run the Lenovo BIOS update utility, which
will update both the BIOS and EC version. See:

-   <https://libreboot.org/docs/install/index.html#flashrom>
-   <http://www.thinkwiki.org/wiki/BIOS_update_without_optical_disk>

NOTE: this can only be done when you are using Lenovo BIOS. How to
update the EC firmware while running libreboot is unknown. Libreboot
only replaces the BIOS firmware, not EC.

Updated EC firmware has several advantages e.g. bettery battery
handling.

Compatibility (without blobs) {#compatibility_noblobs}
-----------------------------

### Hardware virtualization (vt-x) {#hwvirt}

The T400, when run without CPU microcode updates in coreboot, currently
kernel panics if running QEMU with vt-x enabled on 2 cores for the
guest. With a single core enabled for the guest, the guest panics (but
the host is fine). Working around this in QEMU might be possible; if
not, software virtualization should work fine (it's just slower).

On GM45 hardware (with libreboot), make sure that the *kvm* and
*kvm\_intel* kernel modules are not loaded, when using QEMU.

The following errata datasheet from Intel might help with investigation:
<http://download.intel.com/design/mobile/specupdt/320121.pdf>

The T400 is almost identical to the X200, code-wise. See
[x200.html](x200.html).

Hardware register dumps {#regdumps}
-----------------------

The coreboot wiki
[shows](http://www.coreboot.org/Motherboard_Porting_Guide) how to
collect various logs useful in porting to new boards. Following are
outputs from the T400:

-   T400 with **Winbond W25X64** flash chip (8MiB, SOIC-16) and Lenovo
    BIOS 2.02 (EC firmware 1.01):
    -   [../future/dumps/logs-t400-bios2.02-ec1.01/](../future/dumps/logs-t400-bios2.02-ec1.01/)

-   Version of flashrom used for the external flashing/reading logs is
    the one that libreboot git revision c164960 uses.

Copyright © 2015 Leah Rowe <info@minifree.org>\
This page is available under the [CC BY SA 4.0](../cc-by-sa-4.0.txt)
% Flashing the T400 with a BeagleBone Black

Initial flashing instructions for T400.

This guide is for those who want libreboot on their ThinkPad T400 while
they still have the original Lenovo BIOS present. This guide can also be
followed (adapted) if you brick your T400, to know how to recover.

An
["HMM"](https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/43y6629_05.pdf#page=386)
(Hardware Maintenance Manual) detailing the process of \[dis\]assembly
is available for this model. Be careful when reassembling the laptop as
the screws on page 144 (with title "1130 Keyboard bezel") are swapped
and if you follow the HMM you will punch a hole through the bezel in the
upper right corner.

T400 laptops with libreboot pre-installed {#preinstall}
=========================================

If you don't want to install libreboot yourself, companies exist that
sell these laptops with libreboot pre-installed, along with a free
GNU+Linux distribution.

Check the [suppliers](../../suppliers) page for more information.

Serial port {#serial_port}
-----------

EHCI debug might not be needed. It has been reported that the docking
station for this laptop has a serial port, so it might be possible to
use that instead.

A note about CPUs
=================

[ThinkWiki](http://www.thinkwiki.org/wiki/Category:T400) has a list of
CPUs for this system. The Core 2 Duo P8400, P8600 and P8700 are believed
to work in libreboot. The T9600 was confirmed to work, so the
T9500/T9550 probably also work.

Quad-core CPUs
--------------

Incompatible. Do not use.

A note about GPUs
=================

Some models have an Intel GPU, while others have both an ATI and an
Intel GPU; this is referred to as "switchable graphics". In the *BIOS
setup* program for lenovobios, you can specify that the system will use
one or the other (but not both).

Libreboot is known to work on systems with only the Intel GPU, using
native graphics initialization. On systems with switchable graphics, the
Intel GPU is used and the ATI GPU is disabled, so native graphics
initialization works all the same.

CPU paste required
==================

See [\#paste](#paste).

Flash chip size {#flashchips}
===============

Use this to find out:
    # flashrom -p internal -V

MAC address {#macaddress}
===========

On the T400, the MAC address for the onboard gigabit ethernet chipset is
stored inside the flash chip, along with other configuration data.

Keep a note of the MAC address before disassembly; this is very
important, because you will need to insert this into the libreboot ROM
image before flashing it. It will be written in one of these locations:

![](images/t400/macaddress0.jpg) ![](images/t400/macaddress1.jpg)
![](images/x200/disassembly/0001.jpg)

Initial BBB configuration
=========================

Refer to [bbb\_setup.html](bbb_setup.html) for how to configure the BBB
for flashing.

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-16 (clip: Pomona 5252):

    POMONA 5252 (correlate with the BBB guide)
    ===  ethernet jack and VGA port ====
     NC              -       - 21
     1               -       - 17
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     18              -       - 3.3V (PSU)
     22              -       - NC - this is pin 1 on the flash chip
    ===  SATA port ===
    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-8 (clip: Pomona 5250):

    POMONA 5250 (correlate with the BBB guide)
    ===  RAM slots ====
     18              -       - 1
     22              -       - NC
     NC              -       - 21
     3.3V (PSU)      -       - 17 - this is pin 1 on the flash chip
    ===  slot where the AC jack is connected ===

    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

The procedure
-------------

Remove *all* screws, placing them in the order that you removed them:\
![](images/t400/0001.jpg) ![](images/t400/0002.jpg)

Remove those three screws then remove the rear bezel:\
![](images/t400/0003.jpg) ![](images/t400/0004.jpg)
![](images/t400/0005.jpg) ![](images/t400/0006.jpg)

Remove the speakers:\
![](images/t400/0007.jpg) ![](images/t400/0008.jpg)
![](images/t400/0009.jpg) ![](images/t400/0010.jpg)
![](images/t400/0011.jpg)

Remove the wifi:\
![](images/t400/0012.jpg) ![](images/t400/0013.jpg)

Remove this cable:\
![](images/t400/0014.jpg) ![](images/t400/0015.jpg)
![](images/t400/0016.jpg) ![](images/t400/0017.jpg)
![](images/t400/0018.jpg)

Unroute those antenna wires:\
![](images/t400/0019.jpg) ![](images/t400/0020.jpg)
![](images/t400/0021.jpg) ![](images/t400/0022.jpg)
![](images/t400/0023.jpg)

Remove the LCD assembly:\
![](images/t400/0024.jpg) ![](images/t400/0025.jpg)
![](images/t400/0026.jpg) ![](images/t400/0027.jpg)
![](images/t400/0028.jpg) ![](images/t400/0029.jpg)
![](images/t400/0030.jpg) ![](images/t400/0031.jpg)

Disconnect the NVRAM battery:\
![](images/t400/0033.jpg)

Disconnect the fan:\
![](images/t400/0034.jpg)

Unscrew these:\
![](images/t400/0035.jpg) ![](images/t400/0036.jpg)
![](images/t400/0037.jpg) ![](images/t400/0038.jpg)

Unscrew the heatsink, then lift it off:\
![](images/t400/0039.jpg) ![](images/t400/0040.jpg)

Disconnect the power jack:\
![](images/t400/0041.jpg) ![](images/t400/0042.jpg)

Loosen this:\
![](images/t400/0043.jpg)

Remove this:\
![](images/t400/0044.jpg) ![](images/t400/0045.jpg)
![](images/t400/0046.jpg) ![](images/t400/0047.jpg)
![](images/t400/0048.jpg)

Unscrew these:\
![](images/t400/0049.jpg) ![](images/t400/0050.jpg)

Remove this:\
![](images/t400/0051.jpg) ![](images/t400/0052.jpg)

Unscrew this:\
![](images/t400/0053.jpg)

Remove the motherboard (the cage is still attached) from the right hand
side, then lift it out:\
![](images/t400/0054.jpg) ![](images/t400/0055.jpg)
![](images/t400/0056.jpg)

Remove these screws, placing the screws in the same layout and marking
each screw hole (so that you know what ones to put the screws back into
later): ![](images/t400/0057.jpg) ![](images/t400/0058.jpg)
![](images/t400/0059.jpg) ![](images/t400/0060.jpg)
![](images/t400/0061.jpg) ![](images/t400/0062.jpg)

Separate the motherboard:\
![](images/t400/0063.jpg) ![](images/t400/0064.jpg)

Connect your programmer, then connect GND and 3.3V\
![](images/t400/0065.jpg) ![](images/t400/0066.jpg)
![](images/t400/0067.jpg) ![](images/t400/0069.jpg)
![](images/t400/0070.jpg) ![](images/t400/0071.jpg)

A dedicated 3.3V PSU was used to create this guide, but at ATX PSU is
also fine:\
![](images/t400/0072.jpg)

Of course, make sure to turn on your PSU:\
![](images/x200/disassembly/0013.jpg)

Now, you should be ready to install libreboot.

Flashrom binaries for ARM (tested on a BBB) are distributed in
libreboot\_util. Alternatively, libreboot also distributes flashrom
source code which can be built.

Log in as root on your BBB, using the instructions in
[bbb\_setup.html\#bbb\_access](bbb_setup.html#bbb_access).

Test that flashrom works:
    # ./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512
In this case, the output was:

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6406E/MX25L6436E" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6445E/MX25L6473E" (8192 kB, SPI) on linux_spi.
    Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)", "MX25L6406E/MX25L6436E", "MX25L6445E/MX25L6473E"
    Please specify which chip definition to use with the -c <chipname> option.

How to backup factory.rom (change the -c option as neeed, for your flash
chip):\
\# **./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512 -r
factory.rom**\
\# **./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512 -r
factory1.rom**\
\# **./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512 -r
factory2.rom**\
Note: the **-c** option is not required in libreboot's patched
flashrom, because the redundant flash chip definitions in *flashchips.c*
have been removed.\
Now compare the 3 images:

    # sha512sum factory\*.rom
If the hashes match, then just copy one of them (the factory.rom) to a
safe place (on a drive connected to another system, not the BBB). This
is useful for reverse engineering work, if there is a desirable
behaviour in the original firmware that could be replicated in coreboot
and libreboot.

Follow the instructions at
[../hcl/gm45\_remove\_me.html\#ich9gen](../hcl/gm45_remove_me.html#ich9gen)
to change the MAC address inside the libreboot ROM image, before
flashing it. Although there is a default MAC address inside the ROM
image, this is not what you want. **Make sure to always change the MAC
address to one that is correct for your system.**

Now flash it:\
\# **./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512 -w
path/to/libreboot/rom/image.rom -V**

![](images/x200/disassembly/0015.jpg)

You might see errors, but if it says **Verifying flash\... VERIFIED** at
the end, then it's flashed and should boot. If you see errors, try
again (and again, and again); the message **Chip content is identical to
the requested image** is also an indication of a successful
installation.

Example output from running the command (see above):

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Reading old flash chip contents... done.
    Erasing and writing flash chip... FAILED at 0x00001000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x0000ffff: 0xd716
    ERASE FAILED!
    Reading current flash chip contents... done. Looking for another erase function.
    Erase/write done.
    Verifying flash... VERIFIED.

Thermal paste (IMPORTANT)
=========================

Because part of this procedure involved removing the heatsink, you will
need to apply new paste. Arctic MX-4 is ok. You will also need isopropyl
alcohol and an anti-static cloth to clean with.

When re-installing the heatsink, you must first clean off all old paste
with the alcohol/cloth. Then apply new paste. Arctic MX-4 is also much
better than the default paste used on these systems.

![](images/t400/paste.jpg)

NOTE: the photo above is for illustration purposes only, and does not
show how to properly apply the thermal paste. Other guides online detail
the proper application procedure.

Wifi
====

The T400 typically comes with an Intel wifi chipset, which does not work
without proprietary software. For a list of wifi chipsets that work
without proprietary software, see
[../hcl/\#recommended\_wifi](../hcl/#recommended_wifi).

Some T400 laptops might come with an Atheros chipset, but this is
802.11g only.

It is recommended that you install a new wifi chipset. This can only be
done after installing libreboot, because the original firmware has a
whitelist of approved chips, and it will refuse to boot if you use an
'unauthorized' wifi card.

The following photos show an Atheros AR5B95 being installed, to replace
the Intel chip that this T400 came with:\
![](images/t400/0012.jpg) ![](images/t400/ar5b95.jpg)

WWAN
====

If you have a WWAN/3G card and/or sim card reader, remove them
permanently. The WWAN-3G card has proprietary firmware inside; the
technology is identical to what is used in mobile phones, so it can also
track your movements.

Not to be confused with wifi (wifi is fine).

Memory
======

You need DDR3 SODIMM PC3-8500 RAM installed, in matching pairs
(speed/size). Non-matching pairs won't work. You can also install a
single module (meaning, one of the slots will be empty) in slot 0.

Make sure that the RAM you buy is the 2Rx8 density.

[This page](http://www.forum.thinkpads.com/viewtopic.php?p=760721) might
be useful for RAM compatibility info (note: coreboot raminit is
different, so this page might be BS)

The following photo shows 8GiB (2x4GiB) of RAM installed:\
![](images/t400/memory.jpg)

Boot it!
--------

You should see something like this:

![](images/t400/boot0.jpg) ![](images/t400/boot1.jpg)

Now [install GNU+Linux](../gnulinux/).

Copyright © 2015 Leah Rowe <info@minifree.org>\
This page is available under the [CC BY SA 4.0](../cc-by-sa-4.0.txt)


code:
% ThinkPad T500

It is believed that all or most T500 laptops are compatible. See notes
about [CPU
compatibility](../install/t500_external.html#cpu_compatibility) for
potential incompatibilities.

There are two possible flash chip sizes for the T500: 4MiB (32Mbit) or
8MiB (64Mbit). This can be identified by the type of flash chip below
the palmrest: 4MiB is SOIC-8, 8MiB is SOIC-16.

**The T500 laptops come with the ME (and sometimes AMT in addition)
before flashing libreboot. Libreboot disables and removes it by using a
modified descriptor: see [gm45\_remove\_me.html](gm45_remove_me.html)**
(contains notes, plus instructions)

Flashing instructions can be found at
[../install/\#flashrom](../install/#flashrom)

EC update {#ecupdate}
=========

It is recommended that you update to the latest EC firmware version. The
[EC firmware](https://libreboot.org/faq/#firmware-ec) is separate from
libreboot, so we don't actually provide that, but if you still have
Lenovo BIOS then you can just run the Lenovo BIOS update utility, which
will update both the BIOS and EC version. See:

-   <https://libreboot.org/docs/install/index.html#flashrom>
-   <http://www.thinkwiki.org/wiki/BIOS_update_without_optical_disk>

NOTE: this can only be done when you are using Lenovo BIOS. How to
update the EC firmware while running libreboot is unknown. Libreboot
only replaces the BIOS firmware, not EC.

Updated EC firmware has several advantages e.g. bettery battery
handling.

Compatibility (without blobs) {#compatibility_noblobs}
-----------------------------

### Hardware virtualization (vt-x) {#hwvirt}

The T500, when run without CPU microcode updates in coreboot, currently
kernel panics if running QEMU with vt-x enabled on 2 cores for the
guest. With a single core enabled for the guest, the guest panics (but
the host is fine). Working around this in QEMU might be possible; if
not, software virtualization should work fine (it's just slower).

On GM45 hardware (with libreboot), make sure that the *kvm* and
*kvm\_intel* kernel modules are not loaded, when using QEMU.

The following errata datasheet from Intel might help with investigation:
<http://download.intel.com/design/mobile/specupdt/320121.pdf>

The T500 is almost identical to the X200, code-wise. See
[x200.html](x200.html).

Descriptor and Gbe differences {#descriptor_difference}
------------------------------

See
[../future/dumps/t500\_x200\_descriptor/descriptor\_diff\_t500\_x200.txt](../future/dumps/t500_x200_descriptor/descriptor_diff_t500_x200.txt)
and
[../future/dumps/t500\_x200\_descriptor/gbe\_diff\_t500\_x200.txt](../future/dumps/t500_x200_descriptor/gbe_diff_t500_x200.txt)

The patches above are based on the output from ich9deblob on a
factory.rom image dumped from the T500 with a SOIC-8 4MiB flash chip.
The patch re-creates the X200 descriptor/gbe source, so the commands
were something like:
    $ diff -u t500gbe x200gbe
    $ diff -u t500descriptor x200descriptor

ME VSCC table is in a different place and a different size on the T500.
Libreboot disables and removes the ME anyway, so it doesn't matter.

The very same descriptor/gbe used on the X200 (generated by
[ich9gen](gm45_remove_me.html#ich9gen)) was re-used on the T500, and it
still worked.

Hardware register dumps {#regdumps}
-----------------------

The coreboot wiki
[shows](http://www.coreboot.org/Motherboard_Porting_Guide) how to
collect various logs useful in porting to new boards. Following are
outputs from the T500:

-   T500 with **Macronix MX25L3205D** flash chip (4MiB, SOIC-8) and
    Lenovo BIOS 3.13 7VET83WW (EC firmware 1.06):
    -   [../future/dumps/t500log/](../future/dumps/t500log/)

Copyright © 2015 Leah Rowe <info@minifree.org>\
This page is available under the [CC BY SA 4.0](../cc-by-sa-4.0.txt)
% Flashing the T500 with a BeagleBone Black

Initial flashing instructions for T500.

This guide is for those who want libreboot on their ThinkPad T500 while
they still have the original Lenovo BIOS present. This guide can also be
followed (adapted) if you brick your T500, to know how to recover.

Libreboot T400 {#t400}
==============

You may also be interested in the smaller, more portable [Libreboot
T400](t400_external.html).

Serial port {#serial_port}
-----------

EHCI debug might not be needed. It has been reported that the docking
station for this laptop has a serial port, so it might be possible to
use that instead.

A note about CPUs
=================

[ThinkWiki](http://www.thinkwiki.org/wiki/Category:T500) has a list of
CPUs for this system. The Core 2 Duo P8400, P8600 and P8700 are believed
to work in libreboot. The T9600 was also tested on the T400 and
confirmed working, so the T9400/T9500/T9550 probably also work, but they
are untested.

Quad-core CPUs
--------------

Incompatible. Do not use.

A note about GPUs
=================

Some models have an Intel GPU, while others have both an ATI and an
Intel GPU; this is referred to as "switchable graphics". In the *BIOS
setup* program for lenovobios, you can specify that the system will use
one or the other (but not both).

Libreboot is known to work on systems with only the Intel GPU, using
native graphics initialization. On systems with switchable graphics, the
Intel GPU is used and the ATI GPU is disabled, so native graphics
initialization works all the same.

CPU paste required
==================

See [\#paste](#paste).

Flash chip size {#flashchips}
===============

Use this to find out:
    # flashrom -p internal -V

MAC address {#macaddress}
===========

On the T500, the MAC address for the onboard gigabit ethernet chipset is
stored inside the flash chip, along with other configuration data.

Keep a note of the MAC address before disassembly; this is very
important, because you will need to insert this into the libreboot ROM
image before flashing it. It will be written in one of these locations:

![](images/t400/macaddress0.jpg) ![](images/t400/macaddress1.jpg)
![](images/x200/disassembly/0001.jpg)

Initial BBB configuration
=========================

Refer to [bbb\_setup.html](bbb_setup.html) for how to configure the BBB
for flashing.

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-16 (clip: Pomona 5252):

    POMONA 5252 (correlate with the BBB guide)
    ===  ethernet jack and VGA port ====
     NC              -       - 21
     1               -       - 17
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     18              -       - 3.3V (PSU)
     22              -       - NC - this is pin 1 on the flash chip
    ===  SATA port ===
    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-8 (clip: Pomona 5250):

    POMONA 5250 (correlate with the BBB guide)
    ===  RAM slots ====
     18              -       - 1
     22              -       - NC
     NC              -       - 21
     3.3V (PSU)      -       - 17 - this is pin 1 on the flash chip
    ===  slot where the AC jack is connected ===

    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

The procedure
-------------

Remove all screws:\
![](images/t500/0000.jpg)\
It is also advisable to, throughout the disassembly, place any screws
and/or components that you removed in the same layout or arrangement.
The follow photos demonstrate this:\
![](images/t500/0001.jpg) ![](images/t500/0002.jpg)

Remove the HDD/SSD and optical drive:\
![](images/t500/0003.jpg) ![](images/t500/0004.jpg)

Remove the palm rest:\
![](images/t500/0005.jpg) ![](images/t500/0006.jpg)

Remove the keyboard and rear bezel:\
![](images/t500/0007.jpg) ![](images/t500/0008.jpg)
![](images/t500/0009.jpg) ![](images/t500/0010.jpg)
![](images/t500/0011.jpg) ![](images/t500/0012.jpg)

If you have a WWAN/3G card and/or sim card reader, remove them
permanently. The WWAN-3G card has proprietary firmware inside; the
technology is identical to what is used in mobile phones, so it can also
track your movements:\
![](images/t500/0013.jpg) ![](images/t500/0017.jpg)
![](images/t500/0018.jpg)

Remove this frame, and then remove the wifi chip:\
![](images/t500/0014.jpg) ![](images/t500/0015.jpg)
![](images/t500/0016.jpg)

Remove the speakers:\
![](images/t500/0019.jpg) ![](images/t500/0020.jpg)
![](images/t500/0021.jpg) ![](images/t500/0022.jpg)
![](images/t500/0023.jpg) ![](images/t500/0024.jpg)
![](images/t500/0025.jpg)

Remove the NVRAM battery (already removed in this photo):\
![](images/t500/0026.jpg)

When you re-assemble, you will be replacing the wifi chip with another.
These two screws don't hold anything together, but they are included in
your system because the screw holes for half-height cards are a
different size, so use these if you will be installing a half-height
card:\
![](images/t500/0027.jpg)

Unroute the antenna wires:\
![](images/t500/0028.jpg) ![](images/t500/0029.jpg)
![](images/t500/0030.jpg) ![](images/t500/0031.jpg)

Disconnect the LCD cable from the motherboard:\
![](images/t500/0032.jpg) ![](images/t500/0033.jpg)

Remove the LCD assembly hinge screws, and then remove the LCD assembly:\
![](images/t500/0034.jpg) ![](images/t500/0035.jpg)
![](images/t500/0036.jpg)

Remove the fan and heatsink:\
![](images/t500/0037.jpg) ![](images/t500/0038.jpg)
![](images/t500/0039.jpg)

Remove this screw:\
![](images/t500/0040.jpg)

Remove these cables, keeping note of how and in what arrangement they
are connected:\
![](images/t500/0041.jpg) ![](images/t500/0042.jpg)
![](images/t500/0043.jpg) ![](images/t500/0044.jpg)
![](images/t500/0045.jpg) ![](images/t500/0046.jpg)
![](images/t500/0047.jpg) ![](images/t500/0048.jpg)
![](images/t500/0049.jpg)

Disconnect the power jack:\
![](images/t500/0050.jpg) ![](images/t500/0051.jpg)

Remove the motherboard and cage from the base (the marked hole is where
those cables were routed through):\
![](images/t500/0052.jpg) ![](images/t500/0053.jpg)

Remove all screws, arranging them in the same layout when placing the
screws on a surface and marking each screw hole (this is to reduce the
possibility of putting them back in the wrong holes):\
![](images/t500/0054.jpg) ![](images/t500/0055.jpg)

Also remove this:\
![](images/t500/0056.jpg) ![](images/t500/0057.jpg)

Separate the motherboard from the cage:\
![](images/t500/0058.jpg) ![](images/t500/0059.jpg)

The flash chip is next to the memory slots. On this system, it was a
SOIC-8 (4MiB or 32Mb) flash chip:\
![](images/t500/0060.jpg)

Connect your programmer, then connect GND and 3.3V\
![](images/t500/0061.jpg)\
![](images/t400/0067.jpg) ![](images/t400/0069.jpg)
![](images/t400/0070.jpg) ![](images/t400/0071.jpg)

A dedicated 3.3V PSU was used to create this guide, but at ATX PSU is
also fine:\
![](images/t400/0072.jpg)

Of course, make sure to turn on your PSU:\
![](images/x200/disassembly/0013.jpg)

Now, you should be ready to install libreboot.

Flashrom binaries for ARM (tested on a BBB) are distributed in
libreboot\_util. Alternatively, libreboot also distributes flashrom
source code which can be built.

Log in as root on your BBB, using the instructions in
[bbb\_setup.html\#bbb\_access](bbb_setup.html#bbb_access).

Test that flashrom works:
    # ./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512
In this case, the output was:

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6406E/MX25L6436E" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6445E/MX25L6473E" (8192 kB, SPI) on linux_spi.
    Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)", "MX25L6406E/MX25L6436E", "MX25L6445E/MX25L6473E"
    Please specify which chip definition to use with the -c <chipname> option.

How to backup factory.rom (change the -c option as neeed, for your flash
chip):\
\# **./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512 -r
factory.rom**\
\# **./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512 -r
factory1.rom**\
\# **./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512 -r
factory2.rom**\
Note: the **-c** option is not required in libreboot's patched
flashrom, because the redundant flash chip definitions in *flashchips.c*
have been removed.\
Now compare the 3 images:

    # sha512sum factory\*.rom
If the hashes match, then just copy one of them (the factory.rom) to a
safe place (on a drive connected to another system, not the BBB). This
is useful for reverse engineering work, if there is a desirable
behaviour in the original firmware that could be replicated in coreboot
and libreboot.

Follow the instructions at
[../hcl/gm45\_remove\_me.html\#ich9gen](../hcl/gm45_remove_me.html#ich9gen)
to change the MAC address inside the libreboot ROM image, before
flashing it. Although there is a default MAC address inside the ROM
image, this is not what you want. **Make sure to always change the MAC
address to one that is correct for your system.**

Now flash it:\
\# **./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512 -w
path/to/libreboot/rom/image.rom -V**

![](images/x200/disassembly/0015.jpg)

You might see errors, but if it says **Verifying flash\... VERIFIED** at
the end, then it's flashed and should boot. If you see errors, try
again (and again, and again); the message **Chip content is identical to
the requested image** is also an indication of a successful
installation.

Example output from running the command (see above):

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Reading old flash chip contents... done.
    Erasing and writing flash chip... FAILED at 0x00001000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x0000ffff: 0xd716
    ERASE FAILED!
    Reading current flash chip contents... done. Looking for another erase function.
    Erase/write done.
    Verifying flash... VERIFIED.

Thermal paste (IMPORTANT)
=========================

Because part of this procedure involved removing the heatsink, you will
need to apply new paste. Arctic MX-4 is ok. You will also need isopropyl
alcohol and an anti-static cloth to clean with.

When re-installing the heatsink, you must first clean off all old paste
with the alcohol/cloth. Then apply new paste. Arctic MX-4 is also much
better than the default paste used on these systems.

![](images/t400/paste.jpg)

NOTE: the photo above is for illustration purposes only, and does not
show how to properly apply the thermal paste. Other guides online detail
the proper application procedure.

Wifi
====

The T500 typically comes with an Intel wifi chipset, which does not work
without proprietary software. For a list of wifi chipsets that work
without proprietary software, see
[../hcl/\#recommended\_wifi](../hcl/#recommended_wifi).

Some T500 laptops might come with an Atheros chipset, but this is
802.11g only.

It is recommended that you install a new wifi chipset. This can only be
done after installing libreboot, because the original firmware has a
whitelist of approved chips, and it will refuse to boot if you use an
'unauthorized' wifi card.

The following photos show an Atheros AR5B95 being installed, to replace
the Intel chip that this T500 came with:\
![](images/t400/0012.jpg) ![](images/t400/ar5b95.jpg)

WWAN
====

If you have a WWAN/3G card and/or sim card reader, remove them
permanently. The WWAN-3G card has DMA, and proprietary firmware inside;
the technology is identical to what is used in mobile phones, so it can
also track your movements.

Not to be confused with wifi (wifi is fine).

Memory
======

You need DDR3 SODIMM PC3-8500 RAM installed, in matching pairs
(speed/size). Non-matching pairs won't work. You can also install a
single module (meaning, one of the slots will be empty) in slot 0.

Make sure that the RAM you buy is the 2Rx8 density.

[This page](http://www.forum.thinkpads.com/viewtopic.php?p=760721) might
be useful for RAM compatibility info (note: coreboot raminit is
different, so this page might be BS)

The following photo shows 8GiB (2x4GiB) of RAM installed:\
![](images/t400/memory.jpg)

Boot it!
--------

You should see something like this:

![](images/t500/0062.jpg)

Now [install GNU+Linux](../gnulinux/).

Copyright © 2015 Leah Rowe <info@minifree.org>\
This page is available under the [CC BY SA 4.0](../cc-by-sa-4.0.txt)


code:
% T60

Native gpu initialization ('native graphics') which replaces the
proprietary VGA Option ROM ('[Video
BIOS](https://en.wikipedia.org/wiki/Video_BIOS)' or 'VBIOS').

To find what LCD panel you have, see:
[../misc/\#get\_edid\_panelname](../misc/#get_edid_panelname).

**Some T60s have ATI GPUs, and all T60P laptops have ATI GPUs These are
incompatible! See [\#t60\_ati\_intel](#t60_ati_intel) for how to remedy
this.**

Tested LCD panels: **working(compatible)**

-   TMD-Toshiba LTD141EN9B (14.1" 1400x1050) (FRU P/N 41W1478
    recommended for the inverter board)
-   Samsung LTN141P4-L02 (14.1" 1400x1050) (FRU P/N 41W1478 recommended
    for the inverter board)
-   LG-Philips LP150E05-A2K1 (15.1" 1400x1050) (P/N 42T0078 FRU 42T0079
    or P/N 41W1338 recommended for the inverter board)
-   Samsung LTN150P4-L01 (15.1" 1400x1050) (P/N 42T0078 FRU 42T0079 or
    P/N 41W1338 recommended for the inverter board) (not a T60 screen
    afaik, but it works)
-   BOE-Hydis HV150UX1-100 (15.1" 1600x1200) (P/N 42T0078 FRU 42T0079
    or P/N 41W1338 recommended for the inverter board)

Tested LCD panels: **not working yet (incompatible; see
[../future/\#lcd\_i945\_incompatibility](../future/#lcd_i945_incompatibility))**

-   Samsung LTN141XA-L01 (14.1" 1024x768)
-   LG-Philips LP150X09 (15.1" 1024x768)
-   Samsung LTN150XG (15.1" 1024x768)
-   LG-Philips LP150E06-A5K4 (15.1" 1400x1050) (also, not an official
    T60 screen)
-   Samsung LTN154X3-L0A (15.4" 1280x800)
-   IDtech IAQX10N (15.1" 2048x1536) (no display in GRUB, display in
    GNU+Linux is temperamental) (P/N 42T0078 FRU 42T0079 or P/N 41W1338
    recommended for the inverter board)
-   IDtech N150U3-L01 (15.1" 1600x1200) (no display in GRUB, display in
    GNU+Linux works) (P/N 42T0078 FRU 42T0079 or P/N 41W1338 recommended
    for the inverter board)

*The following LCD panels are **UNTESTED**. If you have one of these
panels then please submit a report!*:

-   CMO(IDtech?) N141XC (14.1" 1024x768)
-   BOE-Hydis HT14X14 (14.1" 1024x768)
-   TMD-Toshiba LTD141ECMB (14.1" 1024x768)
-   Boe-Hydis HT14P12 (14.1" 1400x1050) (FRU P/N 41W1478 recommended
    for the inverter board)
-   CMO (IDtech?) 13N7068 (15.1" 1024x768)
-   CMO (IDtech?) 13N7069 (15.1" 1024x768)
-   BOE-Hydis HV150P01-100 (15.1" 1400x1050) (P/N 42T0078 FRU 42T0079
    or P/N 41W1338 recommended for the inverter board)
-   BOE-Hydis HV150UX1-102 (15.1" 1600x1200) (P/N 42T0078 FRU 42T0079
    or P/N 41W1338 recommended for the inverter board)
-   IDtech IAQX10S (15.1" 2048x1536) (P/N 42T0078 FRU 42T0079 or P/N
    41W1338 recommended for the inverter board)
-   Samsung LTN154P2-L05 (42X4641 42T0329) (15.4" 1680x1050)
-   LG-Philips LP154W02-TL10 (13N7020 42T0423) (15.4" 1680x1050)
-   LG-Philips LP154WU1-TLB1 (42T0361) (15.4" 1920x1200) **(for T61p
    but it might work in T60. Unknown!)**
-   Samsung LTN154U2-L05 (42T0408 42T0574) (15.4" 1920x1200) **(for
    T61p but it might work in T60. Unknown!)**

It is unknown whether the 1680x1050 (15.4") and 1920x1200 (15.4")
panels use a different inverter board than the 1280x800 panels.

The T60 typically comes with an Intel wifi chipset which does not work
at all without proprietary firmware, and while Lenovo BIOS is running
the system will refuse to boot if you replace the card. Fortunately it
is very easily replaced; just remove the card and install another one
**after** libreboot is installed. See
[\#recommended\_wifi](#recommended_wifi) for replacements.

ThinkPad T60 (ATI GPU) and ThinkPad T60 (Intel GPU) differences. {#t60_ati_intel}
----------------------------------------------------------------

If your T60 is a 14.1" or 15.1" model with an ATI GPU, it won't work
with libreboot by default but you can replace the motherboard with
another T60 motherboard that has an Intel GPU, and then libreboot should
work.

As far as I know, 14.1" (Intel GPU) and 15.1" (Intel GPU) T60
motherboards are the same, where 'spacers' are used on the 15.1" T60.
In any case, it makes sense to find one that is guaranteed to fit in
your chassis.

There is also a 15.4" T60 with Intel GPU.

Note: the T60**p** laptops all have ATI graphics. The T60p laptops
cannot be used with libreboot under any circumstances.

The following T60 motherboard (see area highlighted in white) shows an
empty space where the ATI GPU would be (this particular motherboard has
an Intel GPU):\
\
![](../images/t60_dev/t60_unbrick.jpg)

The reason that the ATI GPU on T60 is unsupported is due to the VBIOS
(Video BIOS) which is non-free. The VBIOS for the Intel GPU on X60/T60
has been reverse engineered, and replaced with Free Software and so will
work in libreboot.

The 'Video BIOS' is what initializes graphics.

See: <https://en.wikipedia.org/wiki/Video_BIOS>.\
In fact, lack of free VBIOS in general is a big problem in coreboot, and
is one reason (among others) why many ports for coreboot are unsuitable
for libreboot's purpose.

Theoretically, the ThinkPad T60 with ATI GPU can work with libreboot and
have ROM images compiled for it, however in practise it would not be
usable as a laptop because there would be no visual display at all. That
being said, such a configuration is acceptable for use in a 'headless'
server setup (with serial and/or ssh console as the display).

% ThinkPad T60: Recovery guide

This section documents how to recover from a bad flash that prevents
your ThinkPad T60 from booting.

Table of Contents
-----------------

-   Types of brick:
    -   [Brick type 1: bucts not reset](#bucts_brick)
    -   [Brick type 2: bad rom (or user error), system won't
        boot](#recovery)

Brick type 1: bucts not reset. {#bucts_brick}
==============================

You still have Lenovo BIOS, or you had libreboot running and you flashed
another ROM; and you had bucts 1 set and the ROM wasn't dd'd.\* or if
Lenovo BIOS was present and libreboot wasn't flashed.\
\
In this case, unbricking is easy: reset BUC.TS to 0 by removing that
yellow cmos coin (it's a battery) and putting it back after a minute or
two:\
![](../images/t60_dev/0006.JPG)\
\
\*Those dd commands should be applied to all newly compiled T60 ROM
images (the ROM images in libreboot binary archives already have this
applied!):\
dd if=coreboot.rom of=top64k.bin bs=1 skip=\$\[\$(stat -c %s
coreboot.rom) - 0x10000\] count=64k\
dd if=coreboot.rom bs=1 skip=\$\[\$(stat -c %s coreboot.rom) - 0x20000\]
count=64k | hexdump\
dd if=top64k.bin of=coreboot.rom bs=1 seek=\$\[\$(stat -c %s
coreboot.rom) - 0x20000\] count=64k conv=notrunc\
(doing this makes the ROM suitable for use when flashing a system that
still has Lenovo BIOS running, using those instructions:
<http://www.coreboot.org/Board:lenovo/x60/Installation>. (it says x60,
but instructions for t60 are identical)

bad rom (or user error), system won't boot {#recovery}
===========================================

In this scenario, you compiled a ROM that had an incorrect
configuration, or there is an actual bug preventing your system from
booting. Or, maybe, you set BUC.TS to 0 and shut down after first flash
while Lenovo BIOS was running. In any case, your system is bricked and
will not boot at all.

"Unbricking" means flashing a known-good (working) ROM. The problem:
you can't boot the system, making this difficult. In this situation,
external hardware (see hardware requirements above) is needed which can
flash the SPI chip (where libreboot resides).

Remove those screws and remove the HDD:\
![](../images/t60_dev/0001.JPG) ![](../images/t60_dev/0002.JPG)

Lift off the palm rest:\
![](../images/t60_dev/0003.JPG)

Lift up the keyboard, pull it back a bit, flip it over like that and
then disconnect it from the board:\
![](../images/t60_dev/0004.JPG) ![](../images/t60_dev/0005.JPG)
![](../images/t60_dev/0006.JPG)

Gently wedge both sides loose:\
![](../images/t60_dev/0007.JPG) ![](../images/t60_dev/0008.JPG)

Remove that cable from the position:\
![](../images/t60_dev/0009.JPG) ![](../images/t60_dev/0010.JPG)

Now remove that bezel. Remove wifi, nvram battery and speaker connector
(also remove 56k modem, on the left of wifi):\
![](../images/t60_dev/0011.JPG)

Remove those screws:\
![](../images/t60_dev/0012.JPG)

Disconnect the power jack:\
![](../images/t60_dev/0013.JPG)

Remove nvram battery:\
![](../images/t60_dev/0014.JPG)

Disconnect cable (for 56k modem) and disconnect the other cable:\
![](../images/t60_dev/0015.JPG) ![](../images/t60_dev/0016.JPG)

Disconnect speaker cable:\
![](../images/t60_dev/0017.JPG)

Disconnect the other end of the 56k modem cable:\
![](../images/t60_dev/0018.JPG)

Make sure you removed it:\
![](../images/t60_dev/0019.JPG)

Unscrew those:\
![](../images/t60_dev/0020.JPG)

Make sure you removed those:\
![](../images/t60_dev/0021.JPG)

Disconnect LCD cable from board:\
![](../images/t60_dev/0022.JPG)

Remove those screws then remove the LCD assembly:\
![](../images/t60_dev/0023.JPG) ![](../images/t60_dev/0024.JPG)
![](../images/t60_dev/0025.JPG)

Once again, make sure you removed those:\
![](../images/t60_dev/0026.JPG)

Remove the shielding containing the motherboard, then flip it over.
Remove these screws, placing them on a steady surface in the same layout
as they were in before you removed them. Also, you should mark each
screw hole after removing the screw (a permanent marker pen will do),
this is so that you have a point of reference when re-assembling the
system:\
![](../images/t60_dev/0027.JPG) ![](../images/t60_dev/0028.JPG)
![](../images/t60_dev/0029.JPG) ![](../images/t60_dev/0031.JPG)
![](../images/t60_dev/0032.JPG) ![](../images/t60_dev/0033.JPG)

Now wire up the BBB and the Pomona with your PSU.\
Refer to [bbb\_setup.html](bbb_setup.html) for how to setup the BBB for
flashing.\
**Note, the guide mentions a 3.3v DC PSU but you don't need this on the
T60: if you don't have or don't want to use an external PSU, then make
sure not to connect the 3.3v leads mentioned in the guide; instead,
connect the AC adapter (the one that normally charges your battery) so
that the board has power (but don't boot it up)**\
![](../images/t60_dev/0030.JPG)\
Correlate the following with the BBB guide linked above:

    POMONA 5250:
    ===  DVD drive ====
     18              -       - 1
     22              -       - NC               ---- RAM is on this end
     NC              -       - 21
     3.3V (PSU)      -       - 17 - this is pin 1 on the flash chip
    ===  audio jacks ===
    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

Connect the pomona from the BBB to the flash chip. No pics
unfortunately. (use the text diagram above).

Flashrom binaries for ARM (tested on a BBB) are distributed in
libreboot\_util. Alternatively, libreboot also distributes flashrom
source code which can be built.

SSH'd into the BBB:\
\# **./flashrom -p linux\_spi:dev=/dev/spidev1.0,spispeed=512 -w
yourrom.rom**

It should be **Verifying flash\... VERIFIED** at the end. If flashrom
complains about multiple flash chip definitions detected, then choose
one of them following the instructions in the output.

Put those screws back:\
![](../images/t60_dev/0047.JPG)

Put it back into lower chassis:\
![](../images/t60_dev/0048.JPG)

Attach LCD and insert screws (also, attach the lcd cable to the board):\
![](../images/t60_dev/0049.JPG)

Insert those screws:\
![](../images/t60_dev/0050.JPG)

On the CPU (and there is another chip south-east to it, sorry forgot to
take pic) clean off the old thermal paste (with the alcohol) and apply
new (Artic Silver 5 is good, others are good too) you should also clean
the heatsink the same way\
![](../images/t60_dev/0051.JPG)

Attach the heatsink and install the screws (also, make sure to install
the AC jack as highlighted):\
![](../images/t60_dev/0052.JPG)

Reinstall that upper bezel:\
![](../images/t60_dev/0053.JPG)

Do that:\
![](../images/t60_dev/0054.JPG) ![](../images/t60_dev/0055.JPG)

Re-attach modem, wifi, (wwan?), and all necessary cables. Sorry, forgot
to take pics. Look at previous removal steps to see where they go back
to.

Attach keyboard and install nvram battery:\
![](../images/t60_dev/0056.JPG) ![](../images/t60_dev/0057.JPG)

Place keyboard and (sorry, forgot to take pics) reinstall the palmrest
and insert screws on the underside:\
![](../images/t60_dev/0058.JPG)

It lives!\
![](../images/t60_dev/0071.JPG) ![](../images/t60_dev/0072.JPG)
![](../images/t60_dev/0073.JPG)

Always stress test ('stress -c 2' and xsensors. below 90C is ok) when
replacing cpu paste/heatsink:\
![](../images/t60_dev/0074.JPG)

Copyright © 2014, 2015 Leah Rowe <info@minifree.org>\
This page is available under the [CC BY SA 4.0](../cc-by-sa-4.0.txt)


code:
USB

coreboot-4.0-7318-g129462d Mon Dec  8 22:08:18 GMT 2014 starting...
running main(bist = 0)
WARNING: Ignoring S4-assertion-width violation.
Stepping B3
2 CPU cores
AMT enabled
capable of DDR2 of 800 MHz or lower
VT-d enabled
GMCH: GS45, using low power mode by default
TXT enabled
Render frequency: 533 MHz
IGD enabled
PCIe-to-GMCH enabled
GMCH supports DDR3 with 1067 MT or less
GMCH supports FSB with up to 1067 MHz
SMBus controller enabled.
0:50:b
2:51:b
DDR mask 5, DDR 3
Bank 0 populated:
 Raw card type:    F
 Row addr bits:   14
 Col addr bits:   10
 byte width:       1
 page size:     1024
 banks:            8
 ranks:            2
 tAAmin:    105
 tCKmin:     15
  Max clock: 533 MHz
 CAS:       0x01c0
Bank 1 populated:
 Raw card type:    B
 Row addr bits:   15
 Col addr bits:   10
 byte width:       1
 page size:     1024
 banks:            8
 ranks:            1
 tAAmin:    105
 tCKmin:     12
  Max clock: 666 MHz
 CAS:       0x07e0
Trying CAS 7, tCK 15.
Found compatible clock / CAS pair: 533 / 7.
Timing values:
 tCLK:   15
 tRAS:   20
 tRP:     7
 tRCD:    7
 tRFC:  104
 tWR:     8
 tRD:    11
 tRRD:    4
 tFAW:   20
 tWL:     6
Changing memory frequency: old 3, new 6.
Setting IGD memory frequencies for VCO #1.
SFF platform unsupported in RCOMP initialization.
USB

coreboot-4.0-7318-g129462d Mon Dec  8 22:08:18 GMT 2014 starting...
running main(bist = 0)
Interrupted RAM init, reset required.
USB

coreboot-4.0-7318-g129462d Mon Dec  8 22:08:18 GMT 2014 starting...
running main(bist = 0)
Stepping B3
2 CPU cores
AMT enabled
capable of DDR2 of 800 MHz or lower
VT-d enabled
GMCH: GS45, using low power mode by default
TXT enabled
Render frequency: 533 MHz
IGD enabled
PCIe-to-GMCH enabled
GMCH supports DDR3 with 1067 MT or less
GMCH supports FSB with up to 1067 MHz
SMBus controller enabled.
0:50:b
2:51:b
DDR mask 5, DDR 3
Bank 0 populated:
 Raw card type:    F
 Row addr bits:   14
 Col addr bits:   10
 byte width:       1
 page size:     1024
 banks:            8
 ranks:            2
 tAAmin:    105
 tCKmin:     15
  Max clock: 533 MHz
 CAS:       0x01c0
Bank 1 populated:
 Raw card type:    B
 Row addr bits:   15
 Col addr bits:   10
 byte width:       1
 page size:     1024
 banks:            8
 ranks:            1
 tAAmin:    105
 tCKmin:     12
  Max clock: 666 MHz
 CAS:       0x07e0
Trying CAS 7, tCK 15.
Found compatible clock / CAS pair: 533 / 7.
Timing values:
 tCLK:   15
 tRAS:   20
 tRP:     7
 tRCD:    7
 tRFC:  104
 tWR:     8
 tRD:    11
 tRRD:    4
 tFAW:   20
 tWL:     6
Changing memory frequency: old 3, new 6.
Setting IGD memory frequencies for VCO #1.
SFF platform unsupported in RCOMP initialization.
USB

coreboot-4.0-7318-g129462d Mon Dec  8 22:08:18 GMT 2014 starting...
running main(bist = 0)
Interrupted RAM init, reset required.
USB

coreboot-4.0-7318-g129462d Mon Dec  8 22:08:18 GMT 2014 starting...
running main(bist = 0)
Stepping B3
2 CPU cores
AMT enabled
capable of DDR2 of 800 MHz or lower
VT-d enabled
GMCH: GS45, using low power mode by default
TXT enabled
Render frequency: 533 MHz
IGD enabled
PCIe-to-GMCH enabled
GMCH supports DDR3 with 1067 MT or less
GMCH supports FSB with up to 1067 MHz
SMBus controller enabled.
0:50:b
2:51:b
DDR mask 5, DDR 3
Bank 0 populated:
 Raw card type:    F
 Row addr bits:   14
 Col addr bits:   10
 byte width:       1
 page size:     1024
 banks:            8
 ranks:            2
 tAAmin:    105
 tCKmin:     15
  Max clock: 533 MHz
 CAS:       0x01c0
Bank 1 populated:
 Raw card type:    B
 Row addr bits:   15
 Col addr bits:   10
 byte width:       1
 page size:     1024
 banks:            8
 ranks:            1
 tAAmin:    105
 tCKmin:     12
  Max clock: 666 MHz
 CAS:       0x07e0
Trying CAS 7, tCK 15.
Found compatible clock / CAS pair: 533 / 7.
Timing values:
 tCLK:   15
 tRAS:   20
 tRP:     7
 tRCD:    7
 tRFC:  104
 tWR:     8
 tRD:    11
 tRRD:    4
 tFAW:   20
 tWL:     6
Changing memory frequency: old 3, new 6.
Setting IGD memory frequencies for VCO #1.
SFF platform unsupported in RCOMP initialization.