From 15d840558480536ddaca71bc1876254d59fca7fe Mon Sep 17 00:00:00 2001 From: Patrick Rudolph Date: Sat, 4 Aug 2018 10:04:45 +0200 Subject: Documentation: Add basic flashing tutorial for Lenovo * Add basic flashing tutorial ** Describe internal and external flashing ** Describe flash supply diode protection ** Gives general advices on flashing ** Describe how to use flashrom --ifd * Describe basic flashing on Lenovo T4xx devices ** Describe how to disassemble and access the flash IC on T4xx ** Describe flash layout on Sandy Bridge and Ivy Bridge series. Change-Id: Ia833e27f4e7d89ee32be9bed21a0c021839facec Signed-off-by: Patrick Rudolph Reviewed-on: https://review.coreboot.org/27852 Tested-by: build bot (Jenkins) Reviewed-by: Philipp Deppenwiese --- Documentation/flash_tutorial/ext_power.md | 28 ++++++ Documentation/flash_tutorial/ext_standalone.md | 23 +++++ Documentation/flash_tutorial/flash_ic_diode.svg | 61 ++++++++++++ Documentation/flash_tutorial/flash_ic_no_diode.svg | 55 +++++++++++ Documentation/flash_tutorial/index.md | 105 +++++++++++++++++++++ Documentation/flash_tutorial/int_flashrom.md | 19 ++++ Documentation/flash_tutorial/no_ext_power.md | 22 +++++ Documentation/index.md | 1 + Documentation/mainboard/index.md | 14 +++ .../mainboard/lenovo/flashlayout_xx20.svg | 52 ++++++++++ .../mainboard/lenovo/flashlayout_xx30.svg | 61 ++++++++++++ Documentation/mainboard/lenovo/t420.md | 16 ++++ Documentation/mainboard/lenovo/t430.md | 15 +++ Documentation/mainboard/lenovo/t4xx_series.md | 20 ++++ Documentation/mainboard/lenovo/xx20_series.md | 48 ++++++++++ Documentation/mainboard/lenovo/xx30_series.md | 76 +++++++++++++++ 16 files changed, 616 insertions(+) create mode 100644 Documentation/flash_tutorial/ext_power.md create mode 100644 Documentation/flash_tutorial/ext_standalone.md create mode 100644 Documentation/flash_tutorial/flash_ic_diode.svg create mode 100644 Documentation/flash_tutorial/flash_ic_no_diode.svg create mode 100644 Documentation/flash_tutorial/index.md create mode 100644 Documentation/flash_tutorial/int_flashrom.md create mode 100644 Documentation/flash_tutorial/no_ext_power.md create mode 100644 Documentation/mainboard/lenovo/flashlayout_xx20.svg create mode 100644 Documentation/mainboard/lenovo/flashlayout_xx30.svg create mode 100644 Documentation/mainboard/lenovo/t420.md create mode 100644 Documentation/mainboard/lenovo/t430.md create mode 100644 Documentation/mainboard/lenovo/t4xx_series.md create mode 100644 Documentation/mainboard/lenovo/xx20_series.md create mode 100644 Documentation/mainboard/lenovo/xx30_series.md (limited to 'Documentation') diff --git a/Documentation/flash_tutorial/ext_power.md b/Documentation/flash_tutorial/ext_power.md new file mode 100644 index 0000000000..542ccfd934 --- /dev/null +++ b/Documentation/flash_tutorial/ext_power.md @@ -0,0 +1,28 @@ +# Flashing firmware externally supplying direct power + +**WARNING:** Never use a high current rated power supply, like PC ATX power + supply. It'll literally melt your PCB traces on short circuit. + +On some mainboards the flash IC Vcc pin is connected to a diode, which prevents +powering the rest of the board. + +![][flash_ic_diode] + +Please have a look at the mainboard specific documentation for details. + +On those boards it's safe to use a programmer and supply power externally. + +**WARNING:** Verify that you apply the correct voltage! + +## USB programmer +USB programmers are usually current limited by the host USB hub. On USB 2.0 +ports the limit is 500mA, which is sufficient to power the flash. Those are +the best choice as they are stateless and have a fast power on reset cycle. + +## Single board computers (like BeagleBone Black / RPi) +Be careful when connecting a flash chip, especially when using a Pomona +test-clip. A short circuit or overcurrent (250mA) causes a brown-out reset, +resulting in a reboot of the running operating system (and possible loss of +remote shell). + +[flash_ic_diode]: flash_ic_diode.svg diff --git a/Documentation/flash_tutorial/ext_standalone.md b/Documentation/flash_tutorial/ext_standalone.md new file mode 100644 index 0000000000..3a676ce47c --- /dev/null +++ b/Documentation/flash_tutorial/ext_standalone.md @@ -0,0 +1,23 @@ +# Flashing firmware standalone + +If none of the other methods work, there are three possibilities: + +## Desolder +You must remove or desolder the flash IC before you can flash it. +It's recommended to solder a socket in place of the flash IC. + +When flashing the IC, always connect all input pins. +If in doubt, pull /WP, /HOLD, /RESET and alike up towards Vcc. + +## SPI flash emulator +If you are a developer, you might want to use an [EM100Pro] instead, which sets +the onboard flash on hold, and allows to run custom firmware. +It provides a very fast development cycle without actually writing to flash. + +## SPI flash overwrite +It is possible to set the onboard flash on hold and use another flash chip. +Connect all lines one-to-one, except /HOLD. Pull /HOLD of the soldered flash IC +low, and /HOLD of your replacement flash IC high. + + +[EM100Pro]: https://www.dediprog.com/product/EM100Pro diff --git a/Documentation/flash_tutorial/flash_ic_diode.svg b/Documentation/flash_tutorial/flash_ic_diode.svg new file mode 100644 index 0000000000..22cd87277f --- /dev/null +++ b/Documentation/flash_tutorial/flash_ic_diode.svg @@ -0,0 +1,61 @@ + + + + + + + + + + + + + + VCC + + + + + + HOLD + + + + CLK + + + DI + + + + + + + CS + + + WP + + + GND + + + DO + + + + + + + + + + + + + + + + + + diff --git a/Documentation/flash_tutorial/flash_ic_no_diode.svg b/Documentation/flash_tutorial/flash_ic_no_diode.svg new file mode 100644 index 0000000000..543c9262df --- /dev/null +++ b/Documentation/flash_tutorial/flash_ic_no_diode.svg @@ -0,0 +1,55 @@ + + + + + + + + + + + + + + VCC + + + + + + HOLD + + + + CLK + + + DI + + + + + + + CS + + + WP + + + GND + + + DO + + + + + + + + + + + + diff --git a/Documentation/flash_tutorial/index.md b/Documentation/flash_tutorial/index.md new file mode 100644 index 0000000000..1a291372a6 --- /dev/null +++ b/Documentation/flash_tutorial/index.md @@ -0,0 +1,105 @@ +# Flashing firmware tutorial + +Updating the firmware is possible using the **internal method**, where the updates +happen from a running system, or using the **external method**, where the system +is in a shut down state and an external programmer is attached to write into the +flash IC. + +## Contents + +* [Flashing internaly](int_flashrom.md) +* [Flashing firmware standalone](ext_standalone.md) +* [Flashing firmware externally supplying direct power](ext_power.md) +* [Flashing firmware externally without supplying direct power](no_ext_power.md) + +## General advice + +* It's recommended to only flash the BIOS region. +* Always verify the firmware image. +* If you flash externally and have transmission errors: + * Use short wires + * Reduce clock frequency + * Check power supply + * Make sure that there are no other bus masters (EC, ME, SoC, ...) + +## Internal method + +This method using [flashrom] is available on many platforms, as long as they +aren't locked down. + +There are various protection schemes that make it impossible to modify or +replace a firmware from a running system. coreboot allows to disable these +mechanisms, making it possible to overwrite (or update) the firmware from a +running system. + +Usually you must use the **external method** once to install a retrofitted +coreboot and then you can use the **internal method** for future updates. + +There are multiple ways to update the firmware: +* Using flashrom's *internal* programmer to directly write into the firmware + flash IC, running on the target machine itself +* A proprietary software to update the firmware, running on the target machine + itself +* A UEFI firmware update capsule + +More details on flashrom's +* [internal programmer](int_flashrom.md) + +## External method + +External flashing is possible on many platforms, but requires disassembling +the target hardware. You need to buy a flash programmer, that +exposes the same interface as your flash IC (likely SPI). + +Please also have a look at the mainboard-specific documentation for details. + +After exposing the firmware flash IC, read the schematics and use one of the +possible methods: + +* [Flashing firmware standalone](ext_standalone.md) +* [Flashing firmware externally supplying direct power](ext_power.md) +* [Flashing firmware externally without supplying direct power](no_ext_power.md) + +**WARNING:** Using the wrong method or accidentally using the wrong pinout might + permanently damage your hardware! + +## Using a layout file +On platforms where the flash IC is shared with other components you might want +to write only a part of the flash IC. On Intel for example there are IFD, ME and +GBE which don't need to be updated to install coreboot. +To make [flashrom] only write the *bios* region, leaving Intel ME and Intel IFD +untouched, you can use a layout file, which can be created using ifdtool + +```bash +ifdtool -f rom.layout coreboot.rom +``` + +and looks similar to: + +``` +00000000:00000fff fd +00500000:00bfffff bios +00003000:004fffff me +00001000:00002fff gbe +``` + +By specifying *-l* and *-i* [flashrom] writes a single region: +```bash +flashrom -l rom.layout -i bios -w coreboot.rom -p +``` + +## Using an IFD to determine the layout +flashrom version 1.0 supports reading the layout from the IFD (first 4KiB of +the ROM). You don't need to manually specify a layout it, but it only works +under the following conditions: + +* Only available on Intel ICH7+ +* There's only one flash IC when flashing externally + +```bash +flashrom --ifd -i bios -w coreboot.rom -p +``` + +**TODO** explain FMAP regions, normal/fallback mechanism, flash lock mechanisms + +[flashrom]: https://www.flashrom.org/Flashrom diff --git a/Documentation/flash_tutorial/int_flashrom.md b/Documentation/flash_tutorial/int_flashrom.md new file mode 100644 index 0000000000..28b534b003 --- /dev/null +++ b/Documentation/flash_tutorial/int_flashrom.md @@ -0,0 +1,19 @@ +# Flashing firmware internally + +**WARNING:** If you flash a broken firmware and have no recovery mechanism, you + must use the **external method** to flash a working firmware again. + +## Using flashrom +This method does only work on Linux, if it isn't locked down. +You may also need to boot with 'iomem=relaxed' in the kernel command +line if CONFIG_IO_STRICT_DEVMEM is set. + + +For more details please also check [flashrom's wiki]. +Use the programmer *internal* to flash *coreboot.rom* internally: + +```bash +flashrom -p internal -w coreboot.rom +``` + +[flashrom's wiki]: https://www.flashrom.org/Flashrom diff --git a/Documentation/flash_tutorial/no_ext_power.md b/Documentation/flash_tutorial/no_ext_power.md new file mode 100644 index 0000000000..b97ba4cc7a --- /dev/null +++ b/Documentation/flash_tutorial/no_ext_power.md @@ -0,0 +1,22 @@ +# Flashing firmware externally supplying no power + +On some mainboards the flash IC's Vcc pin is connected to the internal +power-rail, powering the entire board if the flash IC is powered externally. +Likely it powers other chips which access the flash IC, preventing the external +programmer from reading/writing the chip. It also violates the components' +power sequence, bringing the ICs into an undefined state. + +![][flash_ic_no_diode] + +Please have a look at the mainboard specific documentation for details. + +On those boards it's recommended to use a programmer without supplying power +externally. + +The key to read and write the flash IC is to put the machine into *S3* sleep- +state or *S5* sleep-state *maybe* with Wake-On-LAN enabled. +Another option that sometimes works is to keep the device in reset. This method requires +knowledge of the board schematics and might require hardware modifications. +Use a multimeter to make sure the flash IC is powered in those sleep states. + +[flash_ic_no_diode]: flash_ic_no_diode.svg diff --git a/Documentation/index.md b/Documentation/index.md index b20eedc10f..e69f2ea7d5 100644 --- a/Documentation/index.md +++ b/Documentation/index.md @@ -23,3 +23,4 @@ Contents: * [Vendorcode-specific documentation](vendorcode/index.md) * [Utilities](util.md) * [Release notes for past releases](releases/index.md) +* [Flashing firmware tutorial](flash_tutorial/index.md) diff --git a/Documentation/mainboard/index.md b/Documentation/mainboard/index.md index 45eb217e4d..c346a3b8f0 100644 --- a/Documentation/mainboard/index.md +++ b/Documentation/mainboard/index.md @@ -26,6 +26,20 @@ This section contains documentation about coreboot on specific mainboards. - [Compaq 8200 Elite SFF](hp/compaq_8200_sff.md) +## Lenovo + +- [T4xx common](lenovo/t4xx_series.md) + +### Sandy Bridge series + +- [T420](lenovo/t420.md) +- [T420 / T520 / X220 / T420s / W520 common](lenovo/xx20_series.md) + +### Ivy Bridge series + +- [T430](lenovo/t430.md) +- [T430 / T530 / X230 / W530 common](lenovo/xx30_series.md) + ## SiFive - [SiFive HiFive Unleashed](sifive/hifive-unleashed.md) diff --git a/Documentation/mainboard/lenovo/flashlayout_xx20.svg b/Documentation/mainboard/lenovo/flashlayout_xx20.svg new file mode 100644 index 0000000000..8884ac37ad --- /dev/null +++ b/Documentation/mainboard/lenovo/flashlayout_xx20.svg @@ -0,0 +1,52 @@ + + + + + + + + IFD + + + + + + + ME + + + + + + + BIOS + + + + + + + GBE + + + + 0x000000 + + + 0x001000 + + + 0x003000 + + + 0x500000 + + + 0x800000 + + + + + Flash #0 + + diff --git a/Documentation/mainboard/lenovo/flashlayout_xx30.svg b/Documentation/mainboard/lenovo/flashlayout_xx30.svg new file mode 100644 index 0000000000..5cc4e4fbaf --- /dev/null +++ b/Documentation/mainboard/lenovo/flashlayout_xx30.svg @@ -0,0 +1,61 @@ + + + + + + + + IFD + + + + + + + ME + + + + + + + BIOS + + + + + + + GBE + + + + 0x000000 + + + 0x001000 + + + 0x003000 + + + 0x500000 + + + 0x800000 + + + + + Flash #0 + + + + + Flash #1 + + + 0xc00000 + + + diff --git a/Documentation/mainboard/lenovo/t420.md b/Documentation/mainboard/lenovo/t420.md new file mode 100644 index 0000000000..ff7a0a9238 --- /dev/null +++ b/Documentation/mainboard/lenovo/t420.md @@ -0,0 +1,16 @@ +# Lenovo T420 + +## Flashing instructions +You have to disassemble the whole device, as the flash IC is on the bottom +of the mainboard. + +For more details have a look at [T420 / T520 / X220 / T420s / W520 common] and + +```eval_rst +:doc:`../../flash_tutorial/ext_power` +``` + +Steps to access the flash IC are described here [T4xx series]. + +[T4xx series]: t4xx_series.md +[T420 / T520 / X220 / T420s / W520 common]: xx20_series.md diff --git a/Documentation/mainboard/lenovo/t430.md b/Documentation/mainboard/lenovo/t430.md new file mode 100644 index 0000000000..787246f4d4 --- /dev/null +++ b/Documentation/mainboard/lenovo/t430.md @@ -0,0 +1,15 @@ +# Lenovo T430 + +## Flashing instructions +You have to disassemble the whole device, as the flash ICs are on the bottom +of the mainboard. + +For more details have a look at [T430 / T530 / X230 / T430s / W530 common] and +```eval_rst +:doc:`../../flash_tutorial/ext_power` +``` + +Steps to access the flash IC are described here [T4xx series]. + +[T4xx series]: t4xx_series.md +[T430 / T530 / X230 / T430s / W530 common]: xx30_series.md diff --git a/Documentation/mainboard/lenovo/t4xx_series.md b/Documentation/mainboard/lenovo/t4xx_series.md new file mode 100644 index 0000000000..23fe0fbe53 --- /dev/null +++ b/Documentation/mainboard/lenovo/t4xx_series.md @@ -0,0 +1,20 @@ +# Lenovo T4xx series disassembly instructions + +A skilled engineer takes around 40 minutes to disassemble, flash and reassemble +the whole device. + +# Steps to access the flash IC: + +* Unplug the main battery +* Remove the harddisk, CDROM, ExpressCard, SIM-card, SDcard, SmartCard, ... +* Open the bottom flap and remove the keyboard screw +* Remove the keyboard +* Remove the screen +* Remove the top enclosure +* Remove the CMOS battery +* Remove the speakers +* Remove WWAN and WIFI card +* Remove the CPU fan +* Unplug the power cable +* Remove the bottom enclosure +* Flip the mainboard and remove the main frame diff --git a/Documentation/mainboard/lenovo/xx20_series.md b/Documentation/mainboard/lenovo/xx20_series.md new file mode 100644 index 0000000000..976a29ba9f --- /dev/null +++ b/Documentation/mainboard/lenovo/xx20_series.md @@ -0,0 +1,48 @@ +# Lenovo Sandy Bridge series + +## Flashing coreboot +```eval_rst ++---------------------+--------------------+ +| Type | Value | ++=====================+====================+ +| Socketed flash | no | ++---------------------+--------------------+ +| Size | 8 MiB | ++---------------------+--------------------+ +| In circuit flashing | Yes | ++---------------------+--------------------+ +| Package | SOIC-8 | ++---------------------+--------------------+ +| Write protection | No | ++---------------------+--------------------+ +| Dual BIOS feature | No | ++---------------------+--------------------+ +| Internal flashing | Yes | ++---------------------+--------------------+ +``` + +## Installation instructions +* Update the EC firmware, as there's no support for EC updates in coreboot. +* Do **NOT** accidently swap pins or power on the board while a SPI flasher + is connected. It will destroy your device. +* It's recommended to only flash the BIOS region. In that case you don't + need to extract BLOBs from vendor firmware. + If you want to flash the whole chip, you need BLOBs when building + coreboot. +* The shipped *Flash layout* allocates 3MiB to the BIOS region, which is the space + usable by coreboot. +* ROM chip size should be set to 8MiB. + +```eval_rst +Please also have a look at :doc:`../../flash_tutorial/index`. +``` + +## Flash layout +There's one 8MiB flash which contains IFD, GBE, ME and BIOS regions. +On Lenovo's UEFI the EC firmware update is placed at the start of the BIOS +region. The update is then written into the EC once. + +![][fl] + +[fl]: flashlayout_xx20.svg + diff --git a/Documentation/mainboard/lenovo/xx30_series.md b/Documentation/mainboard/lenovo/xx30_series.md new file mode 100644 index 0000000000..e65a3f2a6f --- /dev/null +++ b/Documentation/mainboard/lenovo/xx30_series.md @@ -0,0 +1,76 @@ +# Lenovo Ivy Bridge series + +## Flashing coreboot +```eval_rst ++---------------------+--------------------------------+ +| Type | Value | ++=====================+================================+ +| Socketed flash | no | ++---------------------+--------------------------------+ +| Size | 8 MiB + 4MiB | ++---------------------+--------------------------------+ +| In circuit flashing | Yes | ++---------------------+--------------------------------+ +| Package | SOIC-8 | ++---------------------+--------------------------------+ +| Write protection | No | ++---------------------+--------------------------------+ +| Dual BIOS feature | No | ++---------------------+--------------------------------+ +| Internal flashing | Yes | ++---------------------+--------------------------------+ +``` + +## Installation instructions +* Update the EC firmware, as there's no support for EC updates in coreboot. +* Do **NOT** accidently swap pins or power on the board while a SPI flasher + is connected. It will permanently brick your device. +* It's recommended to only flash the BIOS region. In that case you don't + need to extract BLOBs from vendor firmware. + If you want to flash the whole chip, you need BLOBs when building + coreboot. +* The *Flash layout* shows that by default 7MiB of space are available for + the use with coreboot. +* In that case you only want to use a part of the BIOS region that must not + exceed 4MiB in size, which means CONFIG_CBFS_SIZE must be smaller than 4MiB. +* ROM chip size should be set to 12MiB. + +```eval_rst +Please also have a look at :doc:`../../flash_tutorial/index`. +``` + +## Splitting the coreboot.rom + +To split the coreboot.rom into two images (one for the 8MiB and one for the +4 MiB flash IC), run the following commands: + +```bash +dd of=top.rom bs=1M if=build/coreboot.rom skip=8 +dd of=bottom.rom bs=1M if=build/coreboot.rom count=8 +``` + +That gives one ROM for each flash IC, where *top.rom* is the upper part of the +flash image, that resides on the 4 MiB flash and *bottom.rom* is the lower part +of the flash image, that resides on the 8 MiB flash. + +## Dumping a full ROM + +If you flash externally you need to read both flash chips to get two images +(one for the 8MiB and one for the 4 MiB flash IC), and then run the following +command to concatenate the files: + +```bash +cat bottom.rom top.rom > firmware.rom +``` + +## Flash layout +There's one 8MiB and one 4 MiB flash which contains IFD, GBE, ME and +BIOS region. These two flash ICs appear as a single 12MiB when flashing +internally. +On Lenovo's UEFI the EC firmware update is placed at the start of the BIOS +region. The update is then written into the EC once. + +![][fl] + +[fl]: flashlayout_xx30.svg + -- cgit v1.2.3