code:
---
title: How to program an SPI flash chip with the BeagleBone Black or Teensy 3.1
...

This document exists as a guide for reading from or writing to an SPI
flash chip with the BeagleBone Black, using the
[flashrom](http://flashrom.org/Flashrom) software. A BeagleBone Black,
rev. C was used when creating this guide, but earlier revisions may also
work.

*NOTE: this documentation may be outdated, and discusses configuring
SPI flashing on the default Debian system that the BBB sometimes comes
with. If you want an easier time, just use [BBB
ScrewDriver](https://www.coreboot.org/BBB_screwdriver) which comes
pre-configured.*

*This guide is written for Debian Wheezy 7.5, which is what came on the
BBB at the time this guide was written. This one:
<https://debian.beagleboard.org/images/bone-debian-7.8-lxde-4gb-armhf-2015-03-01-4gb.img.xz>*

There was no justification for a further section for the Teensy. Simply
refer to [this page on
flashrom.org](https://www.flashrom.org/Teensy_3.1_SPI_%2B_LPC/FWH_Flasher#ISP_Usage)
for information about how to set it up, and correlate that with the pins
on the SPI flash chip as per other guides in the libreboot documentation
for each board. At the time of writing, the teensy is tested for
flashing on the ThinkPad X200, but it should work for other targets.
here is a photo of the setup for the teensy:
<http://h5ai.swiftgeek.net/IMG_20160601_120855.jpg>

Onto the Beaglebone black...

Hardware requirements
=====================

Shopping list (pictures of this hardware is shown later):

-   A [Flashrom](http://flashrom.org)-compatible external SPI
    programmer: *BeagleBone Black*, sometimes referred to as 'BBB',
    (rev. C) is highly recommended. You can buy one from
    [Adafruit](https://www.adafruit.com) (USA),
    [ElectroKit](http://electrokit.com) (Sweden) or any of the
    distributors listed [here](http://beagleboard.org/black) (look below
    'Purchase'). We recommend this product because we know that it
    works well for our purposes and doesn't require any non-free
    software.

-   Electrical/insulative tape: cover the entire bottom surface of the
    BBB (the part that rests on a surface). This is important, when
    placing the BBB on top of a board so that nothing shorts. Most
    hardware/electronics stores have this. Optionally, you can use the
    bottom half of a [hammond plastic
    enclosure](http://www.hammondmfg.com/1593HAM.htm#BeagleBoneBlack).
-   Clip for connecting to the flash chip: if you have a SOIC-16 flash
    chip (16 pins), you will need the *Pomona 5252* or equivalent. For
    SOIC-8 flash chips (8 pins), you will need the *Pomona 5250* or
    equivalent. Do check which chip you have, before ordering a clip.
    Also, you might as well buy two clips or more since they break
    easily. [Farnell element 14](http://farnell.com/) sells these and
    ships to many countries. Some people find these clips difficult to
    get hold of, especially in South America. If you know of any good
    suppliers, please contact the libreboot project with the relevant
    information. *If you can't get hold of a pomona clip, some other
    clips might work, e.g. 3M, but they are not always reliable. You can
    also directly solder the wires to the chip, if that suits you; the
    clip is just for convenience, really.*
-   *External 3.3V DC power supply*, for powering the flash chip: an
    ATX power supply / PSU (common on Intel/AMD desktop computers) will
    work for this. A lab PSU (DC) will also work (adjusted to 3.3V).
    -   Getting a multimeter might be worthwhile, to verify that it's
        supplying 3.3V.
-   *External 5V DC power supply* (barrel connector), for powering the
    BBB: the latter can have power supplied via USB, but a dedicated
    power supply is recommended. These should be easy to find in most
    places that sell electronics. OPTIONAL. Only needed if not
    powering with the USB cable, or if you want to use [EHCI
    debug](../misc/bbb_ehci.md).
-   *Pin header / jumper cables* (2.54mm / 0.1" headers): you should
    get male--male, male--female and female--female cables in 10cm
    size. Just get a load of them. Other possible names for these
    cables/wires/leads are as follows:
    -   flying leads
    -   breadboard cables (since they are often used on breadboards).
    -   You might also be able to make these cables yourself.

    [Adafruit](https://www.adafruit.com) sell them, as do many others.
    *Some people find them difficult to buy. Please contact the
    libreboot project if you know of any good sellers.* You might also
    be able to make these cables yourself. For PSU connections, using
    long cables, e.g. 20cm, is fine, and you can extend them longer than
    that if needed.
-   *Mini USB A-B cable* (the BeagleBone probably already comes with
    one.) - *OPTIONAL - only needed for [EHCI
    debug](../misc/bbb_ehci.md) or for serial/ssh access without
    ethernet cable (g\_multi kernel module)*
-   *FTDI TTL cable or debug board*: used for accessing the serial
    console on the BBB. [This
    page](http://elinux.org/Beagleboard:BeagleBone_Black_Serial)
    contains a list. *OPTIONAL\---only needed for serial console on
    the BBB, if not using SSH via ethernet cable.*

Setting up the 3.3V DC PSU
==========================

ATX PSU pinouts can be read on [this Wikipedia
page](https://en.wikipedia.org/wiki/Power_supply_unit_%28computer%29#Wiring_diagrams).

You can use pin 1 or 2 (orange wire) on a 20-pin or 24-pin ATX PSU for
3.3V, and any of the ground/earth sources (black cables) for ground.
Short PS\_ON\# / Power on (green wire; pin 16 on 24-pin ATX PSU, or pin
14 on a 20-pin ATX PSU) to a ground (black; there is one right next to
it) using a wire/paperclip/jumper, then power on the PSU by grounding
PS\_ON\# (this is also how an ATX motherboard turns on a PSU).

*DO NOT use pin 4, 6, do NOT use pin 19 or 20 (on a
20-pin ATX PSU), and DO NOT use pin 21, 22 or 23 (on a 24-pin
ATX PSU). Those wires (the red ones) are 5V, and they WILL kill
your flash chip. NEVER supply more than 3.3V to your flash
chip (that is, if it's a 3.3V flash chip; 5V and 1.8V SPI flash chips
do exist, but they are rare. Always check what voltage your chip takes.
Most of them take 3.3V).*

You only need one 3.3V supply and one ground for the flash chip, after
grounding PS\_ON\#.

The male end of a 0.1" or 2.54mm header cable is not thick enough to
remain permanently connected to the ATX PSU on its own. When connecting
header cables to the connector on the ATX PSU, use a female end attached
to a thicker piece of wire (you could use a paper clip), or wedge the
male end of the jumper cable into the sides of the hole in the
connector, instead of going through the centre.

Here is an example set up:\
![](images/x200/psu33.jpg "Copyright © 2015 Patrick "P. J." McDermott <pj@pehjota.net> see license notice at the end of this document")

Accessing the operating system on the BBB
=========================================

The operating system on your BBB will probably have an SSH daemon
running where the root account has no password. Use SSH to access the
operating system and set a root password. By default, the OS on your BBB
will most likely use DHCP, so it should already have an IP address.

You will also be using the OS on your BBB for programming an SPI flash
chip.

Alternatives to SSH (in case SSH fails)
---------------------------------------

You can also use a serial FTDI debug board with GNU Screen, to access
the serial console.
    # screen /dev/ttyUSB0 115200

Here are some example photos:\
![](images/x200/ftdi.jpg) ![](images/x200/ftdi_port.jpg)\

You can also connect the USB cable from the BBB to another computer and
a new network interface will appear, with its own IP address. This is
directly accessible from SSH, or screen:

    # screen /dev/ttyACM0 115200

You can also access the uboot console, using the serial method instead
of SSH.

Setting up spidev on the BBB
============================

Log on as root on the BBB, using either SSH or a serial console as
defined in [\#bbb\_access](#bbb_access). Make sure that you have
internet access on your BBB.

Follow the instructions at
<http://elinux.org/BeagleBone_Black_Enable_SPIDEV#SPI0> up to (and
excluding) the point where it tells you to modify uEnv.txt

You need to update the software on the BBB first. If you have an
element14 brand BBB (sold by Premier Farnell plc. stores like Farnell
element14, Newark element14, and Embest), you may need to [work around a
bug](https://groups.google.com/forum/?_escaped_fragment_=msg/beagleboard/LPjCn4LEY2I/alozBGsbTJMJ#!msg/beagleboard/LPjCn4LEY2I/alozBGsbTJMJ)
in the LED aging init script before you can update your software. If you
don't have a file named /etc/init.d/led\_aging.sh, you can skip this
step and update your software as described below. Otherwise, replace the
contents of this file with:

    #!/bin/sh -e
    ### BEGIN INIT INFO
    # Provides:          led_aging.sh
    # Required-Start:    $local_fs
    # Required-Stop:     $local_fs
    # Default-Start:     2 3 4 5
    # Default-Stop:      0 1 6
    # Short-Description: Start LED aging
    # Description:       Starts LED aging (whatever that is)
    ### END INIT INFO

    x=$(/bin/ps -ef | /bin/grep "[l]ed_acc")
    if [ ! -n "$x" -a -x /usr/bin/led_acc ]; then
        /usr/bin/led_acc &
    fi

Run `apt-get update` and `apt-get upgrade` then reboot the BBB,
before continuing.
Check that the firmware exists:

    # ls /lib/firmware/BB-SPI0-01-00A0.

Output:

    /lib/firmware/BB-SPI0-01-00A0.dtbo

Then:

    # echo BB-SPI0-01 > /sys/devices/bone_capemgr./slots
    # cat /sys/devices/bone_capemgr./slots

Output:

     0: 54:PF---
     1: 55:PF---
     2: 56:PF---
     3: 57:PF---
     4: ff:P-O-L Bone-LT-eMMC-2G,00A0,Texas Instrument,BB-BONE-EMMC-2G
     5: ff:P-O-L Bone-Black-HDMI,00A0,Texas Instrument,BB-BONELT-HDMI
     7: ff:P-O-L Override Board Name,00A0,Override Manuf,BB-SPI0-01

Verify that the spidev device now exists:

    # ls -al /dev/spid

Output:

    crw-rw---T 1 root spi 153, 0 Nov 19 21:07 /dev/spidev1.0

Now the BBB is ready to be used for flashing. Make this persist across
reboots:\
In /etc/default/capemgr add `CAPE=BB-SPI0-01` at the end (or change
the existing `CAPE=` entry to say that, if an entry already exists.

Get flashrom from the libreboot\_util release archive, or build it from
libreboot\_src/git if you need to. An ARM binary (statically compiled)
for flashrom exists in libreboot\_util releases. Put the flashrom binary
on your BBB.

You may also need ich9gen, if you will be flashing an ICH9-M laptop
(such as the X200). Get it from libreboot\_util, or build it from
libreboot\_src, and put the ARM binary for it on your BBB.

Finally, get the ROM image that you would like to flash and put that on
your BBB.

Now test flashrom:

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512

Output:

    Calibrating delay loop... OK.
    No EEPROM/flash device found.
    Note: flashrom can never write if the flash chip isn't found automatically.

This means that it's working (the clip isn't connected to any flash
chip, so the error is fine).

Connecting the Pomona 5250/5252
===============================

Use this image for reference when connecting the pomona to the BBB:
<http://beagleboard.org/Support/bone101#headers> (D0 = MISO or connects
to MISO).

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-16 (clip: Pomona 5252):

     NC              -       - 21
     1               -       - 17
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     18              -       - 3.3V (PSU)
     22              -       - NC - this is pin 1 on the flash chip
    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

    You may also need to connect pins 1 and 9 (tie to 3.3V supply). These are HOLD# and WP#.
    On some systems they are held high, if the flash chip is attached to the board.
    If you're flashing a chip that isn't connected to a board, you'll almost certainly
    have to connect them.

    SOIC16 pinout (more info available online, or in the datasheet for your flash chip):
    HOLD    1-16    SCK
    VDD 2-15    MOSI
    N/C 3-14    N/C
    N/C 4-13    N/C
    N/C 5-12    N/C
    N/C 6-11    N/C
    SS  7-10    GND
    MISO    8-9 WP

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-8 (clip: Pomona 5250):

     18              -       - 1
     22              -       - NC
     NC              -       - 21
     3.3V (PSU)      -       - 17 - this is pin 1 on the flash chip
    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

    You may also need to connect pins 3 and 7 (tie to 3.3V supply). These are HOLD# and WP#.
    On some systems they are held high, if the flash chip is attached to the board.
    If you're flashing a chip that isn't connected to a board, you'll almost certainly
    have to connect them.

    SOIC8 pinout (more info available online, or in the datasheet for your flash chip):
    SS  1-8 VDD
    MISO    2-7 HOLD
    WP  3-6 SCK
    GND 4-5 MOSI

`NC = no connection`

*DO NOT connect 3.3V (PSU) yet. ONLY connect this once the pomona is
connected to the flash chip.*

*You also need to connect the BLACK wire (ground/earth) from the 3.3V
PSU to pin 2 on the BBB (P9 header). It is safe to install this now
(that is, before you connect the pomona to the flash chip); in fact, you
should.*

if you need to extend the 3.3v psu leads, just use the same colour M-F
leads, *but* keep all other leads short (10cm or less)

You should now have something that looks like this:\
![](images/x200/5252_bbb0.jpg) ![](images/x200/5252_bbb1.jpg)

Copyright © 2014, 2015 Leah Rowe <info@minifree.org>\
Copyright © 2015 Patrick "P. J." McDermott <pj@pehjota.net>\
Copyright © 2015 Albin Söderqvist\

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License Version 1.3 or any later
version published by the Free Software Foundation
with no Invariant Sections, no Front Cover Texts, and no Back Cover Texts.
A copy of this license is found in [../fdl-1.3.md](../fdl-1.3.md)


code:
---
title: ASUS Chromebook C201 installation guide
x-toc-enable: true
...

These instructions are for installing Libreboot to the ASUS Chromebook
C201. Since the device ships with Coreboot, the installation
instructions are the same before and after flashing Libreboot for the
first time.

*If you are using libreboot\_src or git, then make sure that you built
the sources first (see [../git/\#build](../git/#build)).*

Look at the [list of ROM images](#rom) to see which image is compatible
with your device.

Libreboot can be installed internally from the device, with sufficient
privileges. The installation process requires using *Google's modified
version of flashrom*, that has support for reflashing the Chromebook's
SPI flash. Otherwise, flashing externally will work with the upstream
flashrom version.

*Google's modified version of flashrom* is free software and its
source code is made available by Google:
[flashrom](https://chromium.googlesource.com/chromiumos/third_party/flashrom/).\
It is not distributed along with Libreboot yet. However, it is
preinstalled on the device, with ChromeOS.

Installing Libreboot internally requires sufficient privileges on the system
installed on the device. When the device has ChromeOS installed (as it does
initially), it is necessary to gain root privileges in ChromeOS, to be able to
access a root shell.

Gaining root privileges on ChromeOS
--------------------------------

In order to gain root privileges on ChromeOS, developer mode has to be
enabled from the recovery mode screen and debugging features have to be
enabled in ChromeOS.

Instructions to access the [recovery mode
screen](../depthcharge/#recovery_mode_screen) and [enabling developer
mode](../depthcharge/#enabling_developer_mode) are available on the page
dedicated to [depthcharge](../depthcharge/).

Once developer mode is enabled, the device will boot to the [developer
mode screen](../depthcharge/#developer_mode_screen). ChromeOS can be
booted by waiting for 30 seconds (the delay is shortened in Libreboot)
or by pressing *Ctrl + D*

After the system has booted, root access can be enabled by clicking on
the *Enable debugging features* link. A confirmation dialog will ask
whether to proceed.\
After confirming by clicking *Proceed*, the device will reboot and ask
for the root password to set. Finally, the operation has to be confirmed
by clicking *Enable*.

After setting the root password, it becomes possible to log-in as root.
A tty prompt can be obtained by pressing *Ctrl + Alt + Next*. The
*Next* key is the one on the top left of the keyboard.

Preparing the device for the installation
Before installing Libreboot on the device, both its software and
hardware has to be prepared to allow the installation procedure and to
ensure that security features don't get in the way.

Configuring verified boot parameters
------------------------------------

It is recommended to have access to the [developer mode
screen](../depthcharge/#developer_mode_screen) and to [configure the
following verified boot
parameters](../depthcharge/#configuring_verified_boot_parameters):

-   Kernels signature verification: *disabled*
-   External media boot: *enabled*

Those changes can be reverted later, when the device is known to be in a
working state.

Removing the write protect screw
--------------------------------

Since part of the SPI flash is write-protected by a screw, it is
necessary to remove the screw to remove the write protection and allow
writing Libreboot to the *read-only* part of the flash.

To access the screw, the device has to be opened. There are 8 screws to
remove from the bottom of the device, as shown on the picture below. Two
are hidden under the top pads. After removing the screws, the keyboard
plastic part can be carefully detached from the rest. *Beware: there
are cables attached to it!* It is advised to flip the keyboard plastic
part over, as shown on the picture below. The write protect screw is
located next to the SPI flash chip, circled in red in the picture below.
It has to be removed.

[![Screws](images/c201/screws.jpg)](images/c201/screws.jpg) [![WP
screw](images/c201/wp-screw.jpg)](images/c201/wp-screw.jpg)

The write protect screw can be put back in place later, when the device
is known to be in a working state.

Installing Libreboot to the SPI flash
=====================================

The SPI flash (that holds Libreboot) is divided into various partitions
that are used to implement parts of the CrOS security system. Libreboot
is installed in the *read-only* coreboot partition, that becomes
writable after removing the write-protect screw.

Installing Libreboot internally, from the device
------------------------------------------------

Before installing Libreboot to the SPI flash internally, the device has
to be reassembled.

All the files from the `veyron_speedy` release (or build) have to be
transferred to the device.

The following operations have to be executed with root privileges on the
device (e.g. using the `root` account). In addition, the
`cros-flash-replace` script has to be made executable:

    # chmod a+x cros-flash-replace

The SPI flash has to be read first:

    # flashrom -p host -r flash.img

*Note: it might be a good idea to copy the produced flash.img file at
this point and store it outside of the device for backup purposes.*

Then, the `cros-flash-replace` script has to be executed as such:

    # ./cros-flash-replace flash.img coreboot ro-frid

If any error is shown, it is definitely a bad idea to go further than
this point.

The resulting flash image can then be flashed back:

    # flashrom -p host -w flash.img

You should also see within the output the following:

    Verifying flash... VERIFIED.

Shut down. The device will now boot to Libreboot.

Installing Libreboot externally, with a SPI flash programmer
------------------------------------------------------------

Before installing Libreboot to the SPI flash internally, the device has
to be opened.

The SPI flash is located next to the write protect screw. Its layout is
indicated in the picture below. Note that it is not necessary to connect
`WP#` since removing the screw already connects it to ground. Before
writing to the chip externally, the battery connector has to be
detached. It is located under the heat spreader, that has to be
unscrewed from the rest of the case. The battery connector is located on
the right and has colorful cables, as shown on the picture below.

[![SPI flash
layout](images/c201/spi-flash-layout.jpg)](images/c201/spi-flash-layout.jpg)
[![Battery
connector](images/c201/battery-connector.jpg)](images/c201/battery-connector.jpg)

All the files from the `veyron_speedy` release (or build) have to be
transferred to the host.

The following operations have to be executed with root privileges on the
host (e.g. using the `root` account). In addition, the
`cros-flash-replace` script has to be made executable:

    # chmod a+x cros-flash-replace

The SPI flash has to be read first (using the right spi programmer):

    # flashrom -p *programmer* -r flash.img

*Note: it might be a good idea to copy the produced flash.img file at
this point and store it outside of the device for backup purposes.*

Then, the `cros-flash-replace` script has to be executed as such:

    # ./cros-flash-replace flash.img coreboot ro-frid

If any error is shown, it is definitely a bad idea to go further than
this point.

The resulting flash image can then be flashed back (using the right spi
programmer):

    # flashrom -p *programmer* -w flash.img

You should also see within the output the following:

    Verifying flash... VERIFIED.

The device will now boot to Libreboot.

Installing Debian
---------------------
Debian is recommended for this device (which is on that list.

See <https://wiki.debian.org/InstallingDebianOn/Asus/C201>.

Copyright © 2015 Paul Kocialkowski <contact@paulk.fr>\

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License Version 1.3 or any later
version published by the Free Software Foundation
with no Invariant Sections, no Front Cover Texts, and no Back Cover Texts.
A copy of this license is found in [../fdl-1.3.md](../fdl-1.3.md)

repo_name: zyliwax/libreboot

license: mit


code:
---
title: D510MO flashing tutorial
...

This guide is for those who want libreboot on their Intel D510MO
motherboard while they still have the original BIOS present.

Flash chip size {#flashchips}
===============

Use this to find out:

    # flashrom -p internal -V

Flashing instructions {#clip}
=====================

Refer to [bbb\_setup.md](bbb_setup.md) for how to set up the BBB for
flashing.

This is an image of the flash chip, for reference:\
![](../images/d510mo/d510mo.jpg)

Copyright © 2016 Leah Rowe <info@minifree.org>\

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License Version 1.3 or any later
version published by the Free Software Foundation
with no Invariant Sections, no Front Cover Texts, and no Back Cover Texts.
A copy of this license is found in [../fdl-1.3.md](../fdl-1.3.md)


code:
---
title: Intel D945GCLF flashing tutorial
...

This guide is for those who want libreboot on their Intel D945GCLF
motherboard while they still have the original BIOS present.

For information about this board, go to
[../hardware/d945gclf.md](../hardware/d945gclf.md)

Flashing instructions {#clip}
=====================

Refer to [bbb\_setup.md](bbb_setup.md) for how to set up the BBB for
external flashing.

Here is an image of the flash chip:\
![](../images/d945gclf/d945gclf_spi.jpg)

Copyright © 2016 Leah Rowe <info@minifree.org>\

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License Version 1.3 or any later
version published by the Free Software Foundation
with no Invariant Sections, no Front Cover Texts, and no Back Cover Texts.
A copy of this license is found in [../fdl-1.3.md](../fdl-1.3.md)


code:
---
title: GA-G41M-ES2L flashing tutorial
...

This guide is for those who want libreboot on their Intel GA-G41M-ES2L
motherboard while they still have the original BIOS present.

Flash chip size {#flashchips}
===============

Use this to find out:

    # flashrom -p internal -V

Flashing instructions {#clip}
=====================

Refer to [bbb\_setup.md](bbb_setup.md) for how to set up the BBB for
external flashing. *You can only externally reprogram one of the chips
at a time, and you need to disable the chip that you're not flashing,
by connecting 3v3 to /CS of that chip, so you will actually need 2 test
clips (you also need to connect GND on the chip that you're
disabling).*

Here is an image of the flash chip:\
![](../images/ga-g41m-es2l/ga-g41m-es2l.jpg)

Internal flashing is possible. Boot with the proprietary BIOS and
GNU+Linux. There are 2 flash chips (one is backup).

Flash the first chip:

    ./flashrom -p internal:dualbiosindex=0 -w libreboot.rom

Flash the second chip:

    ./flashrom -p internal:dualbiosindex=1 -w libreboot.rom

NOTE: you can still boot the system with just the main flash chip
connected, after desoldering the backup chip. This has been tested while
libreboot was already installed onto the main chip.

NOTE: You need the latest flashrom. Just get it on flashrom.org from
their SVN or Git repos.

NOTE: due to a bug in the hardware, the MAC address is hardcoded in
coreboot-libre. Therefore, you must set your own MAC address in your
operating system.

Copyright © 2016 Leah Rowe <info@minifree.org>\

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License Version 1.3 or any later
version published by the Free Software Foundation
with no Invariant Sections, no Front Cover Texts, and no Back Cover Texts.
A copy of this license is found in [../fdl-1.3.md](../fdl-1.3.md)


code:
---
title: Installation instructions
...

This section relates to installing Libreboot on supported targets.

NOTE: if running `flashrom -p internal` for software based flashing, and you
get an error related to `/dev/mem` access, you should reboot with
`iomem=relaxed` kernel parameter before running flashrom, or use a kernel that
has `CONFIG_STRICT_DEVMEM` not enabled.

Which systems are Libreboot compatible with?
--------------------------------------------

-   [Information about Libreboot hardware compatibility](../hardware/)

General information
-------------------

-   [Information about libreboot ROM images](#rom)

Flashing via software methods, on system:
-----------------------------------------

-   [How to update or install libreboot on all systems](#flashrom)
-   [ASUS KFSN4-DRE](#flashrom)
-   [ThinkPad X60/T60 (if running Lenovo BIOS)](#flashrom_lenovobios)
-   [Apple MacBook2,1](#flashrom_macbook21)
-   [ASUS Chromebook C201](c201.md)

Setting up programmers, for external SPI flashing
-----------------------------------------------------------------

-   [BeagleBone Black Setup](bbb_setup.md)
-   [Raspberry Pi Setup](rpi_setup.md)

Flashing via hardware methods, on system:
-----------------------------------------

-   [Gigabyte GA-G41-ES2L](ga-g41m-es2l.md)
-   [Intel D510MO](d510mo.md)
-   [Intel D945GCLF](d945gclf.md)
-   [ASUS KGPE-D16](kgpe-d16.md)
-   [ASUS KCMA-D8](kcma-d8.md)
-   [ASUS Chromebook C201](c201.md)
-   [ThinkPad X60](x60_unbrick.md)
-   [ThinkPad X60 Tablet](x60tablet_unbrick.md)
-   [ThinkPad T60](t60_unbrick.md)
-   [ThinkPad X200/X200S/X200T](x200_external.md)
-   [ThinkPad R400](r400_external.md)
-   [ThinkPad T400](t400_external.md)
-   [ThinkPad T500](t500_external.md)
-   [ThinkPad W500](t500_external.md)

Information about libreboot ROM images {#rom}
======================================

Libreboot distributes pre-compiled ROM images, built from the libreboot
source code. These images are provided for user convenience, so that
they don't have to build anything from source on their own.

The ROM images in each archive use the following at the end of the file
name, if they are built with the GRUB payload: `*_*keymap*_*mode*.rom`

Available `modes`: `vesafb` or `txtmode`. The `vesafb` ROM images
are recommended, in most cases; `txtmode` ROM images come with
MemTest86+, which requires text-mode instead of the usual framebuffer
used by coreboot native graphics initialization.

`keymap` can be one of several keymaps that keyboard supports (there are
quite a few), which affects the keyboard layout configuration that is
used in GRUB. It doesn't matter which ROM image you choose here, as far
as the keymap in GNU+Linux is concerned.

Keymaps are named appropriately according to each keyboard layout
support in GRUB. To learn how these keymaps are created, see
[../grub/\#grub\_keyboard](../grub/#grub_keyboard)

QEMU
----

Libreboot comes with ROM images built for QEMU, by default:

Examples of how to use libreboot ROM images in QEMU:

    $ qemu-system-i386 -M q35 -m 512 -bios qemu_q35_ich9_keymap_mode.rom
    $ qemu-system-i386 -M pc -m 512 -bios qemu_i440fx_piix4_keymap_mode.rom

You can optionally specify the `-serial stdio` argument, so that QEMU
will emulate a serial terminal on the standard input/output (most likely
your terminal emulator or TTY).

Other arguments are available for QEMU. The manual will contain more
information.

How to update or install libreboot (if you are already running libreboot or coreboot) {#flashrom}
=====================================================================================

On all current targets, updating libreboot can be accomplished without
disassembly and, therefore, without having to externally re-flash using
any dedicated hardware. In other words, you can do everything entirely
in software, directly from the OS that is running on your libreboot
system.

*If you are using `libreboot_src` or git, then make sure that you built the
sources first (see [../git/\#build](../git/#build)).*

Look at the [list of ROM images](#rom) to see which image is compatible
with your device.

Are you currently running the original, proprietary firmware?
-------------------------------------------------------------

If you are currently running the proprietary firmware (not libreboot or
coreboot), then the flashing instructions for your system are going to
be different.

X60/T60 users running the proprietary firmware should refer to
[\#flashrom\_lenovobios](#flashrom_lenovobios). MacBook2,1 users running
Apple EFI should refer to [\#flashrom\_macbook21](#flashrom_macbook21)

X200 users, refer to [x200\_external.md](x200_external.md), R400
users refer to [r400\_external.md](r400_external.md), T400 users
refer to [t400\_external.md](t400_external.md), T500 and W500 users refer to
[t500\_external.md](t500_external.md)

ASUS KFSN4-DRE?
---------------

Internal flashing should work just fine, even if you are currently
booting the proprietary firmware.

Libreboot currently lacks documentation for externally re-flashing an
LPC flash chip. However, these boards have the flash chip inside of a
PLCC socket, and it is possible to hot-swap the chips. If you want to
back up your known-working image, simply hot-swap the chip for one that
is the same capacity, after having dumped a copy of the current firmware
(flashrom -p internal -r yourchosenname.rom), and then flash that chip
with the known-working image. Check whether the system still boots, and
if it does, then it should be safe to flash the new image (because you
now have a backup of the old image).

Keeping at least one spare LPC PLCC chip with working firmware on it is
highly recommended, in case of bricks.

*DO NOT hot-swap the chip with your bare hands. Use a PLCC chip
extractor. These can be found online. See
<http://www.coreboot.org/Developer_Manual/Tools#Chip_removal_tools>*

Do check the HCL entry: [../hardware/kfsn4-dre.md](../hardware/kfsn4-dre.md)

ASUS KGPE-D16?
--------------

If you have the proprietary BIOS, you need to flash libreboot
externally. See [kgpe-d16.md](kgpe-d16.md).

If you already have coreboot or libreboot installed, without write
protection on the flash chip, then you can do it in software (otherwise,
see link above).

*DO NOT hot-swap the chip with your bare hands. Use a PDIP-8 chip
extractor. These can be found online. See
<http://www.coreboot.org/Developer_Manual/Tools#Chip_removal_tools>*

Do check the HCL entry: [../hardware/kgpe-d16.md](../hardware/kgpe-d16.md)

ASUS KCMA-D8?
-------------

If you have the proprietary BIOS, you need to flash libreboot
externally. See [kcma-d8.md](kgpe-d8.md).

If you already have coreboot or libreboot installed, without write
protection on the flash chip, then you can do it in software (otherwise,
see link above).

*DO NOT hot-swap the chip with your bare hands. Use a PDIP-8 chip
extractor. These can be found online. See
<http://www.coreboot.org/Developer_Manual/Tools#Chip_removal_tools>*

Do check the HCL entry: [../hardware/kcma-d8.md](../hardware/kcma-d8.md)

Intel D945GCLF?
---------------

If you're running the original Intel factory BIOS, then you will need
to flash externally. For instructions on how to do that, refer to
[d945gclf.md](d945gclf.md).

Otherwise, read the generic instructions below for using the *flash*
script.

Are you currently running libreboot (or coreboot)?
--------------------------------------------------

X60/T60 users should be fine with this guide. If you write-protected the
flash chip, please refer to [x60\_unbrick.md](x60_unbrick.md),
[x60tablet\_unbrick.md](x60tablet_unbrick.md) or
[t60\_unbrick.md](t60_unbrick.md). *This probably does not apply to
you. Most people do not write-protect the flash chip, so you probably
didn't either.*

Similarly, it is possible to write-protect the flash chip in coreboot or
libreboot on GM45 laptops (X200/R400/T400/T500/W500). If you did this, then
you will need to use the links above for flashing, treating your laptop
as though it currently has the proprietary firmware (because
write-protected SPI flash requires external re-flashing, as is also the
case when running the proprietary firmware).

If you did not write-protect the flash chip, or it came to you without
any write-protection (*libreboot does not write-protect the flash chip
by default, so this probably applies to you*), read on!

MAC address on GM45 (X200/R400/T400/T500/W500)
-----------------------------------------

*Users of the X200/R400/T400/T500/W500 take note:* The MAC address for the
onboard ethernet chipset is located inside the flash chip. Libreboot ROM
images for these laptops contain a generic MAC address by default, but
this is not what you want. *Make sure to change the MAC address inside
the ROM image, before flashing it. The instructions on
[../hardware/gm45\_remove\_me.html\#ich9gen](../hardware/gm45_remove_me.html#ich9gen)
show how to do this.*

It is important that you change the default MAC address, before
flashing. It will be printed on a sticker at the bottom of the laptop,
or it will be printed on a sticker next to or underneath the RAM.
Alternatively, and assuming that your current firmware has the correct
MAC address in it, you can get it from your OS.

Apple iMac 5,2?
---------------

Internal flashing works, even when flashing from Apple EFI to libreboot.
Continue reading the instructions below.

*NOTE: If you're flashing an older version of Libreboot, the iMac5,2
motherboard is compatible with the MacBook2,1. Simply flash a MacBook2,1
ROM image, and it should work.*

Flash chip size
---------------

Use this to find out:

    # flashrom -p internal -V

All good?
---------

Excellent! Moving on...

Download the *libreboot\_util.tar.xz* archive, and extract it. Inside,
you will find a directory called *flashrom*. This contains statically
compiled executable files of the *flashrom* utility, which you will use
to re-flash your libreboot system.

Simply use *cd* on your terminal, to switch to the *libreboot\_util*
directory. Inside, there is a script called *flash*, which will detect
what CPU architecture you have (e.g. i686, x86\_64) and use the
appropriate executable. It is also possible for you to build these
executables from the libreboot source code archives.

How to update the flash chip contents:

    $ sudo ./flash update [yourrom.rom](#rom)

Ocassionally, coreboot changes the name of a given board. If flashrom
complains about a board mismatch, but you are sure that you chose the
correct ROM image, then run this alternative command:

    $ sudo ./flash forceupdate [yourrom.rom](#rom)

You should see `Verifying flash... VERIFIED.` written at the end
of the flashrom output. *Shut down* after you see this, and then boot
up again after a few seconds.

ThinkPad X60/T60: Initial installation guide (if running the proprietary firmware) {#flashrom_lenovobios}
==================================================================================

*This is for the ThinkPad X60 and T60 while running Lenovo BIOS. If you
already have coreboot or libreboot running, then go to
[\#flashrom](#flashrom) instead!*

*If you are flashing a Lenovo ThinkPad T60, be sure to read
[../hardware/\#supported\_t60\_list](../hardware/#supported_t60_list)*

*If you are using libreboot\_src or git, then make sure that you built
the sources first (see [../git/\#build](../git/#build)).*

*Warning: this guide will not instruct the user how to backup the
original Lenovo BIOS firmware. These backups are tied to each system,
and will not work on any other. For that, please refer to
<http://www.coreboot.org/Board:lenovo/x60/Installation>.*

*If you're using libreboot 20150518, note that there is a mistake in
the flashing script. do this: *

    rm -f patch
    wget -O flash https://notabug.org/libreboot/libreboot/raw/9d850543ad90b72e0e333c98075530b31e5d23f1/flash
    chmod +x flash

The first half of the procedure is as follows:

    $ sudo ./flash i945lenovo\_firstflash [yourrom.rom](#rom).

You should see within the output the following:

    Updated BUC.TS=1 - 64kb address ranges at 0xFFFE0000 and 0xFFFF0000 are
    swapped

You should also see within the output the following:

    Your flash chip is in an unknown state
    ...
    FAILED
    ...
    DO NOT REBOOT OR POWEROFF

Seeing this means that the operation was a *resounding* success!
*DON'T PANIC*.

See this link for more details:
<http://thread.gmane.org/gmane.linux.bios.flashrom/575>.

If the above is what you see, then *SHUT DOWN*. Wait a few seconds,
and then boot; libreboot is running, but there is a 2nd procedure
needed (see below).

When you have booted up again, you must also do this:

    $ sudo ./flash i945lenovo\_secondflash [yourrom.rom](#rom)

If flashing fails at this stage, try the following:

    # sudo ./flashrom/i686/flashrom -p

internal:laptop=force\_I\_want\_a\_brick -w [yourrom.rom](#rom)

You should see within the output the following:

    Updated BUC.TS=0 - 128kb address range 0xFFFE0000-0xFFFFFFFF is
    untranslated

You should also see within the output the following:

    Verifying flash... VERIFIED.

MacBook2,1: Initial installation guide (if running the proprietary firmware) {#flashrom_macbook21}
============================================================================

*If you have a MacBook1,1, refer to
[../hardware/\#macbook11](../hardware/#macbook11) for flashing instructions.*

*This is for the MacBook2,1 while running Apple EFI firmware. If you
already have coreboot or libreboot running, then go to
[\#flashrom](#flashrom) instead!*

Be sure to read the information in
[../hardware/\#macbook21](../hardware/#macbook21).

*Warning: this guide will not instruct the user how to backup the
original Apple EFI firmware. For that, please refer to
<http://www.coreboot.org/Board:apple/macbook21>.*

*If you are using libreboot\_src or git, then make sure that you built
the sources first (see [../git/\#build](../git/#build)).*

Look at the [list of ROM images](#rom) to see which image is compatible
with your device.

Use this flashing script, to install libreboot:

    $ sudo ./flash i945apple\_firstflash [yourrom.rom](#rom)

You should also see within the output the following:

    Verifying flash... VERIFIED.

Shut down.

Copyright © 2014, 2015, 2016 Leah Rowe <info@minifree.org>\

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License Version 1.3 or any later
version published by the Free Software Foundation
with no Invariant Sections, no Front Cover Texts, and no Back Cover Texts.
A copy of this license is found in [../fdl-1.3.md](../fdl-1.3.md)


code:
---
title: KCMA-D8 external flashing instructions
x-toc-enable: true
...

Initial flashing instructions for kcma-d8.

This guide is for those who want libreboot on their ASUS kcma-d8
motherboard, while they still have the proprietary ASUS BIOS present.
This guide can also be followed (adapted) if you brick you board, to
know how to recover.

*Memory initialization is still problematic, for some modules. We
recommend avoiding Kingston modules.*

For more general information about this board, refer to
[../hardware/kcma-d8.md](../hardware/kcma-d8.md).

TODO: show photos here, and other info.

External programmer {#programmer}
===================

Refer to [bbb\_setup.md](bbb_setup.md) for a guide on how to set up
an external SPI programmer.

The flash chip is in a PDIP 8 socket (SPI flash chip) on the
motherboard, which you take out and then re-flash with libreboot, using
the programmer. *DO NOT* remove the chip with your hands. Use a chip
extractor tool.

Copyright © 2016 Leah Rowe <info@minifree.org>\

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License Version 1.3 or any later
version published by the Free Software Foundation
with no Invariant Sections, no Front Cover Texts, and no Back Cover Texts.
A copy of this license is found in [../fdl-1.3.md](../fdl-1.3.md)


code:
---
title: KGPE-D16 external flashing instructions
x-toc-enable: true
...

Initial flashing instructions for KGPE-D16.

This guide is for those who want libreboot on their ASUS KGPE-D16
motherboard, while they still have the proprietary ASUS BIOS present.
This guide can also be followed (adapted) if you brick you board, to
know how to recover.

*Memory initialization is still problematic, for some modules. We
recommend avoiding Kingston modules.*

For more general information about this board, refer to
[../hardware/kgpe-d16.md](../hardware/kgpe-d16.md).

TODO: show photos here, and other info.

External programmer
===================

Refer to [bbb\_setup.md](bbb_setup.md) for a guide on how to set up
an external SPI programmer.

The flash chip is in a PDIP 8 socket (SPI flash chip) on the
motherboard, which you take out and then re-flash with libreboot, using
the programmer. *DO NOT* remove the chip with your hands. Use a chip
extractor tool.

Copyright © 2015 Leah Rowe <info@minifree.org>\

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License Version 1.3 or any later
version published by the Free Software Foundation
with no Invariant Sections, no Front Cover Texts, and no Back Cover Texts.
A copy of this license is found in [../fdl-1.3.md](../fdl-1.3.md)


code:
---
title: Flashing the R400 with a BeagleBone Black
...

Initial flashing instructions for R400.

This guide is for those who want libreboot on their ThinkPad R400 while
they still have the original Lenovo BIOS present. This guide can also be
followed (adapted) if you brick your R400, to know how to recover.

Before following this section, please make sure to setup your libreboot
ROM properly first. Although ROM images are provided pre-built in
libreboot, there are some modifications that you need to make to the one
you chose before flashing. (instructions referenced later in this guide)

Libreboot T400 {#t400}
==============

You may also be interested in the smaller, more portable [Libreboot
T400](t400_external.md).

Serial port {#serial_port}
-----------

EHCI debug might not be needed. It has been reported that the docking
station for this laptop has a serial port, so it might be possible to
use that instead.

A note about CPUs
=================

[ThinkWiki](http://www.thinkwiki.org/wiki/Category:R400) has a list of
CPUs for this system. The Core 2 Duo P8400 and P8600 are believed to
work in libreboot. The Core 2 Duo T9600 was confirmed to work, so the
T9400 probably also works. *The Core 2 Duo T5870/5670 and Celeron M
575/585 are untested!*

Quad-core CPUs
--------------

Incompatible. Do not use.

A note about GPUs
=================

Some models have an Intel GPU, while others have both an ATI and an
Intel GPU; this is referred to as "switchable graphics". In the *BIOS
setup* program for lenovobios, you can specify that the system will use
one or the other (but not both).

Libreboot is known to work on systems with only the Intel GPU, using
native graphics initialization. On systems with switchable graphics, the
Intel GPU is used and the ATI GPU is disabled, so native graphics
initialization works all the same.

CPU paste required
==================

See [\#paste](#paste).

Flash chip size {#flashchips}
===============

Use this to find out:

    # flashrom -p internal -V

MAC address {#macaddress}
===========

On the R400, the MAC address for the onboard gigabit ethernet chipset is
stored inside the flash chip, along with other configuration data.

Keep a note of the MAC address before disassembly; this is very
important, because you will need to insert this into the libreboot ROM
image before flashing it. It will be written in one of these locations:

![](images/t400/macaddress0.jpg) ![](images/t400/macaddress1.jpg)
![](images/x200/disassembly/0001.jpg)

Initial BBB configuration
=========================

Refer to [bbb\_setup.md](bbb_setup.md) for how to setup the BBB for
flashing.

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-16 (clip: Pomona 5252):

    POMONA 5252 (correlate with the BBB guide)
    ===  ethernet jack and VGA port ====
     NC              -       - 21
     1               -       - 17
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     18              -       - 3.3V (PSU)
     22              -       - NC - this is pin 1 on the flash chip
    ===  SATA port ===
    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-8 (clip: Pomona 5250):

    POMONA 5250 (correlate with the BBB guide)
    ===  RAM slots ====
     18              -       - 1
     22              -       - NC
     NC              -       - 21
     3.3V (PSU)      -       - 17 - this is pin 1 on the flash chip
    ===  slot where the AC jack is connected ===
    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

Disassembly
-----------

Remove all screws:\
![](images/r400/0000.jpg)\
Remove the HDD and optical drive:\
![](images/r400/0001.jpg)\
Remove the hinge screws:\
![](images/r400/0002.jpg) ![](images/r400/0003.jpg)

Remove the palm rest and keyboard:\
![](images/r400/0004.jpg) ![](images/r400/0005.jpg)

Remove these screws, and then remove the bezel:\
![](images/r400/0006.jpg) ![](images/r400/0007.jpg)

Remove the speaker screws, but don't remove the speakers yet (just set
them loose):\
![](images/r400/0008.jpg) ![](images/r400/0009.jpg)
![](images/r400/0010.jpg)

Remove these screws, and then remove the metal plate:\
![](images/r400/0011.jpg) ![](images/r400/0012.jpg)
![](images/r400/0013.jpg)

Remove the antennas from the wifi card, and then start unrouting them:\
![](images/r400/0014.jpg) ![](images/r400/0015.jpg)
![](images/r400/0016.jpg) ![](images/r400/0017.jpg)
![](images/r400/0018.jpg) ![](images/r400/0019.jpg)

Disconnect the LCD cable from the motherboard:\
![](images/r400/0020.jpg) ![](images/r400/0021.jpg)
![](images/r400/0022.jpg) ![](images/r400/0023.jpg)

Remove the hinge screws, and then remove the LCD panel:\
![](images/r400/0024.jpg) ![](images/r400/0025.jpg)
![](images/r400/0026.jpg) ![](images/r400/0027.jpg)

Remove this:\
![](images/r400/0028.jpg) ![](images/r400/0029.jpg)

Remove this long cable (there are 3 connections):\
![](images/r400/0030.jpg) ![](images/r400/0031.jpg)
![](images/r400/0032.jpg) ![](images/r400/0033.jpg)

Disconnect the speaker cable, and remove the speakers:\
![](images/r400/0034.jpg)

Remove the heatsink screws, remove the fan and then remove the
heatsink/fan:\
![](images/r400/0035.jpg) ![](images/r400/0036.jpg)
![](images/r400/0037.jpg) ![](images/r400/0038.jpg)

Remove the NVRAM battery:\
![](images/r400/0039.jpg) ![](images/r400/0040.jpg)

Remove this screw:\
![](images/r400/0041.jpg) ![](images/r400/0042.jpg)

Disconnect the AC jack:\
![](images/r400/0043.jpg) ![](images/r400/0044.jpg)

Remove this screw and then remove what is under it:\
![](images/r400/0045.jpg)

Remove this:\
![](images/r400/0046.jpg)

Lift the motherboard (which is still inside the cage) from the side on
the right, removing it completely:\
![](images/r400/0047.jpg) ![](images/r400/0048.jpg)

Remove all screws, marking each hole so that you know where to re-insert
them. You should place the screws in a layout corresponding to the order
that they were in before removal: ![](images/r400/0049.jpg)
![](images/r400/0050.jpg)

Remove the motherboard from the cage, and the SPI flash chip will be
next to the memory slots:\
![](images/r400/0051.jpg) ![](images/r400/0052.jpg)

Connect your programmer, then connect GND and 3.3V\
![](images/t400/0065.jpg) ![](images/t400/0066.jpg)
![](images/t400/0067.jpg) ![](images/t400/0069.jpg)
![](images/t400/0070.jpg) ![](images/t400/0071.jpg)

A dedicated 3.3V PSU was used to create this guide, but at ATX PSU is
also fine:\
![](images/t400/0072.jpg)

Of course, make sure to turn on your PSU:\
![](images/x200/disassembly/0013.jpg)

Now, you should be ready to install libreboot.

Flashrom binaries for ARM (tested on a BBB) are distributed in
libreboot\_util. Alternatively, libreboot also distributes flashrom
source code which can be built.

Log in as root on your BBB, using the instructions in
[bbb\_setup.html\#bbb\_access](bbb_setup.html#bbb_access).

Test that flashrom works:

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512\

In this case, the output was:

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6406E/MX25L6436E" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6445E/MX25L6473E" (8192 kB, SPI) on linux_spi.
    Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)", "MX25L6406E/MX25L6436E", "MX25L6445E/MX25L6473E"
    Please specify which chip definition to use with the -c <chipname> option.

How to backup factory.rom (change the -c option as neeed, for your flash
chip):

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r

factory.rom

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r

factory1.rom

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r

factory2.rom

Note: the `-c` option is not required in libreboot's patched
flashrom, because the redundant flash chip definitions in *flashchips.c*
have been removed.

Now compare the 3 images:

    # sha512sum factory*.rom

If the hashes match, then just copy one of them (the factory.rom) to a
safe place (on a drive connected to another system, not the BBB). This
is useful for reverse engineering work, if there is a desirable
behaviour in the original firmware that could be replicated in coreboot
and libreboot.

Follow the instructions at
[../hardware/gm45\_remove\_me.html\#ich9gen](../hardware/gm45_remove_me.html#ich9gen)
to change the MAC address inside the libreboot ROM image, before
flashing it. Although there is a default MAC address inside the ROM
image, this is not what you want. *Make sure to always change the MAC
address to one that is correct for your system.*

Now flash it:

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -w

path/to/libreboot/rom/image.rom -V

![](images/x200/disassembly/0015.jpg)

You might see errors, but if it says `Verifying flash... VERIFIED` at
the end, then it's flashed and should boot. If you see errors, try
again (and again, and again); the message `Chip content is identical to
the requested image` is also an indication of a successful
installation.

Example output from running the command (see above):

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Reading old flash chip contents... done.
    Erasing and writing flash chip... FAILED at 0x00001000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x0000ffff: 0xd716
    ERASE FAILED!
    Reading current flash chip contents... done. Looking for another erase function.
    Erase/write done.
    Verifying flash... VERIFIED.

Thermal paste (IMPORTANT)
=========================

Because part of this procedure involved removing the heatsink, you will
need to apply new paste. Arctic MX-4 is ok. You will also need isopropyl
alcohol and an anti-static cloth to clean with.

When re-installing the heatsink, you must first clean off all old paste
with the alcohol/cloth. Then apply new paste. Arctic MX-4 is also much
better than the default paste used on these systems.

![](images/t400/paste.jpg)

NOTE: the photo above is for illustration purposes only, and does not
show how to properly apply the thermal paste. Other guides online detail
the proper application procedure.

Wifi
====

The R400 typically comes with an Intel wifi chipset, which does not work
without proprietary software. For a list of wifi chipsets that work
without proprietary software, see
[../hardware/\#recommended\_wifi](../hardware/#recommended_wifi).

Some R400 laptops might come with an Atheros chipset, but this is
802.11g only.

It is recommended that you install a new wifi chipset. This can only be
done after installing libreboot, because the original firmware has a
whitelist of approved chips, and it will refuse to boot if you use an
'unauthorized' wifi card.

The following photos show an Atheros AR5B95 being installed, to replace
the Intel chip that this R400 came with:\
![](images/t400/0012.jpg) ![](images/t400/ar5b95.jpg)

WWAN
====

If you have a WWAN/3G card and/or sim card reader, remove them
permanently. The WWAN-3G card has proprietary firmware inside; the
technology is identical to what is used in mobile phones, so it can also
track your movements.

Not to be confused with wifi (wifi is fine).

Memory
======

You need DDR3 SODIMM PC3-8500 RAM installed, in matching pairs
(speed/size). Non-matching pairs won't work. You can also install a
single module (meaning, one of the slots will be empty) in slot 0.

Make sure that the RAM you buy is the 2Rx8 density.

[This page](http://www.forum.thinkpads.com/viewtopic.php?p=760721) might
be useful for RAM compatibility info (note: coreboot raminit is
different, so this page might be BS)

The following photo shows 8GiB (2x4GiB) of RAM installed:\
![](images/t400/memory.jpg)

Boot it!
--------

You should see something like this:

![](images/t400/boot0.jpg) ![](images/t400/boot1.jpg)

Now [install GNU+Linux](../gnulinux/).

Copyright © 2014, 2015 Leah Rowe <info@minifree.org>\

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License Version 1.3 or any later
version published by the Free Software Foundation
with no Invariant Sections, no Front Cover Texts, and no Back Cover Texts.
A copy of this license is found in [../fdl-1.3.md](../fdl-1.3.md)


code:
---
title: How to program an SPI flash chip with the Raspberry Pi
...

This document exists as a guide for reading from or writing to an SPI flash
chip with the Raspberry Pi, using the [flashrom](http://flashrom.org/Flashrom)
software. Most revisions of the RPi should work.

The Libreboot project recommends using
[blobless GNU+Linux](https://blog.rosenzweig.io/blobless-linux-on-the-pi.html)
on the Raspberry Pi, to avoid having to run non-free software. This only became
possible in February 2017 and the instructions below are not yet updated with
the necessary steps, so please do not follow the steps below unless you are
willing to run non-free software on your Raspberry Pi.

This only covers SOIC-8 flash chips, for now. SOIC-16 guide coming later (for
now, it should be easy enough for you to figure this out for SOIC-16).

Raspberry Pi (ThinkPad X60/T60 and Macbook 2,1)
------------------------------------------------

The Raspberry Pi (a multipurpose \$25 GNU+Linux computer) can be used as
a BIOS flashing tool, thanks to its GPIO pins and SPI support.

Note: The Raspberry Pi Model A is not supported, since it has no GPIO pins.

### Disassembling the ThinkPad

Follow the [X60 Hardware Maintenance
Manual](http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42x3550_04.pdf)
or [T60 Hardware Maintenance
Manual](http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/42t7844_04.pdf)
to disassemble the laptop, until you can access the BIOS chip.

For photos, follow the [Libreboot T60 Recovery
Guide](t60_unbrick.md).

-   On the X60, the BIOS chip is on the bottom of the motherboard, under
    a layer of protective black tape.

-   On the T60, the BIOS chip is just under the palmrest, but blocked by
    a magnesium frame (which you will have to remove).

### Pomona Clip Pinout

Diagram of the 26 GPIO Pins of the Raspberry Pi Model B (for the Model
B+ with 40 pins, start counting from the right and leave 14 pins):

![](images/rpi/0012.png) ![](images/rpi/0013.png)

     8-pin for X60:

    ~~~~ LCD (Front) ~~~~
            8765
            ----
            |  |
            ----
            1234
    ~~~ Palmrest (back) ~~

  Pin \#   SPI Pin Name   BP (Seeed)   BP (Spkfun)   [Beagleboard Black](http://beagleboard.org/Support/bone101#headers)   [Raspberry Pi](images/rpi/0000.jpg)
  -------- -------------- ------------ ------------- --------------------------------------------------------------------- -------------------------------------
  1        CS             White        Red           Pin 17                                                                24
  2        MISO           Black        Brown         Pin 21                                                                21
  3        *not used*     *not used*   *not used*    *not used*                                                            *not used*
  4        GND            Brown        Black         Pin 1                                                                 25
  5        MOSI           Gray         Orange        Pin 18                                                                19
  6        CLK            Purple       Yellow        Pin 22                                                                23
  7        *not used*     *not used*   *not used*    *not used*                                                            *not used*
  8        3.3V           *red*        White         [3.3V PSU RED](bbb_setup.md)      17

Make sure the pinouts are correct; otherwise, Flashrom will fail to
detect a chip, or it will "detect" a `0x0` chip. Finally, make sure
that the Pomona clip makes contact with the metal wires of the chip. It
can be a challenge, but keep trying.

### How to supply power to the flashchip

There are two ways to supply power to the chip: plugging in an AC
adapter (without turning the laptop on), and using the 8th 3.3v pin.

I have found that the SST chips work best with the 8th pin, while the
Macronix chips require an AC Adapter to power up.

*Never connect both the 8th pin and the AC adapter at the same time.*

Your results may vary.

Reading the Flashchip
----------------------

First, visually inspect (with a magnifying glass) the type of flashchip
on the motherboard.

Next, download and compile the latest Flashrom source code on the
Raspberry Pi.

    sudo apt-get install build-essential pciutils usbutils libpci-dev libusb-dev libftdi1 libftdi-dev zlib1g-dev subversion libusb-1.0-0-dev
    svn co svn://flashrom.org/flashrom/trunk flashrom
    cd flashrom
    make
    sudo modprobe spi_bcm2708
    sudo modprobe spidev

If your chip is an SST, run this command:

    sudo ./flashrom -p linux_spi:dev=/dev/spidev0.0 -r test.rom

If your chip is a Macronix, run this command:

    sudo ./flashrom -c "MX25L1605" -p linux_spi:dev=/dev/spidev0.0 -r test.rom

Next, check the md5sum of the dump:

    md5sum test.rom

Run the `flashrom` command again to make a second dump. Then, check the
md5sum of the second dump:

    md5sum test.rom

If the md5sums match after three tries, `flashrom` has managed to read
the flashchip precisely (but not always accurately). You may try and
flash Libreboot now.

Flashing Libreboot
-------------------

Note: replace `/path/to/libreboot.rom` with the location of your chosen ROM,
such as `../bin/x60/libreboot_usqwerty.rom`):

If your chip is an SST, run this command:

    sudo ./flashrom -p linux_spi:dev=/dev/spidev0.0 -w /path/to/libreboot.rom

If your chip is a Macronix, run this command:

    sudo ./flashrom -c "MX25L1605" -p linux_spi:dev=/dev/spidev0.0 -w /path/to/libreboot.rom

Once that command outputs the following, the flash has completed
successfully. If not, just flash again.

    Reading old flash chip contents... done.
    Erasing and writing flash chip... Erase/write done.
    Verifying flash... VERIFIED.

### Sources

-   [Scruss - Simple ADC with the Raspberry
    Pi](http://scruss.com/blog/2013/02/02/simple-adc-with-the-raspberry-pi/)
-   [Flashing coreboot on a T60 with a Raspberry Pi -
    the\_unconventional's
    blog](https://blogs.fsfe.org/the_unconventional/2015/05/08/flashing-coreboot-on-a-t60-with-a-raspberry-pi/)
-   *Pomona SOIC Clip flashing*
    -   [Arch Linux Wiki - Installing Arch Linux on
        Chromebook](https://wiki.archlinux.org/index.php/Chromebook)
    -   [Google Drive - Raspberry Pi SOIC Clip
        connection](https://drive.google.com/folderview?id=0B9f62MH0umbmRTA2Xzd5WHhjWEU&usp=sharing)
    -   [rPI with Flashrom and SOIC Clip
        Powerpoint](http://satxhackers.org/wp/hack-content/uploads/2013/04/rPI_flashrom.pdf)

### Raspberry Pi Pinout Diagrams

  MCP   3008 Pin   Pi GPIO Pin \#   Pi Pin Name
  ----- ---------- ---------------- --------------------
  16    `VDD`      1                `3.3 V`
  15    `VREF`     1                `3.3 V`
  14    `AGND`     6                `GND`
  13    `CLK`      23               `GPIO11 SPI0_SCLK`
  12    `DOUT`     21               `GPIO09 SPI0_MISO`
  11    `DIN`      19               `GPIO10 SPI0_MOSI`
  10    `CS`       24               `GPIO08 CE0`
  9     `DGND`     6                `GND`

-   Source: [Perl & Raspberry Pi - Raspberry Pi GPIO
    Pinout](http://raspberrypi.znix.com/hipidocs/topic_gpiopins.htm)

Raspberry Pi (ThinkPad X200)
-----------------------------

### Requirements:

-   An x86, x86\_64, or arm7l (for changing the libreboot.rom image mac
    address)
-   Raspberry Pi and peripherals
-   Relevant SOIC clip
-   6 female - female jumpers
-   Internet connection
-   Screw drivers

Follow the [ThinkPad X200: Initial installation
guide](x200_external.md) to
disassemble the laptop, and access the BIOS rom chip.

Note: `x86#` refers to commands to be run on the x86 computer, and `pi#` refers
to commands to be run on the pi. A good practice is to make a work directory to
keep your libreboot stuff inside.

    x86# mkdir ~/work

Download NOOBS from [The Raspberry Pi
Foundation.](https://www.raspberrypi.org/downloads/) Torrent download
recommended, and remember to seed. :)

If you're running Raspian, you can do `sudo raspi-config`, enable SPI
under Advanced and then spidev will be enabled. Simple, eh?

[Download Libreboot from their releases
page](../../download/). For your safety, verify the
GPG signature as well.

    x86# gpg --keyserver prefered.keyserver.org --recv-keys 0x656F212E

    x86# for signature in $(ls *.sig); do gpg --verify $signature; done

Extract NOOBS and libreboot.

    x86# mkdir ~/work/noobs

    x86# unzip ~/Downloads/NOOBS_v1_4_1.zip -d ~/work/noobs/

    x86# cd ~/work && tar -xvJf ~/Downloads/libreboot_bin.tar.xz

Install Noobs to your fat32 formatted SD card

    x86# cp -R ~/work/noobs/* /path/to/mounted/SDcard/

### Set up NOOBS on Raspberry Pi

Plug in the NOOBs SDCard to your Raspberry Pi, and enable the following
under 'Advanced Options':

SSH server

SPI

I2C

On first boot

    pi# sudo apt-get update && sudo apt-get dist-upgrade && reboot

On second boot

    pi# sudo apt-get update && sudo apt-get install libftdi1 libftdi-dev libusb-dev libpci-dev subversion libusb-1.0-0-dev

Other dependencies that should already be installed with the noobs base
install include:

pciutils, zlib, libusb, build-essential

If they are missing then install them.

Download and build flashrom.

    pi# svn co svn://flashrom.org/flashrom/trunk ~/flashrom

    pi# cd ~/flashrom

    pi# make

    pi# sudo make install

On your x86 box change the libreboot.rom mac address

    x86# cd ~/work/libreboot_bin/

Change the mac address on the libreboot images to match yours.

    x86# ./ich9macchange XX:XX:XX:XX:XX:XX

Move the libreboot.rom image over to your pi

    x86# scp ~/work/libreboot_bin/<path_to_your_bin> pi@your.pi.address:~/flashrom/libreboot.rom

Shutdown your pi, write down your rom chip model, and wire up the clip

    pi# sudo shutdown now -hP

Chip model name

![](images/rpi/0001.jpg)

Pinout. You may want to download the image so you can zoom in on the
text.

![](images/rpi/0002.jpg)

  Pin \#   SPI Pin Name   Raspberry Pi Pin \#
  -------- -------------- ---------------------
  1        *not used*     *not used*
  2        3.3V           1
  3        *not used*     *not used*
  4        *not used*     *not used*
  5        *not used*     *not used*
  6        *not used*     *not used*
  7        CS\#           24
  8        S0/SIO1        21
  9        *not used*     *not used*
  10       GND            25
  11       *not used*     *not used*
  12       *not used*     *not used*
  13       *not used*     *not used*
  14       *not used*     *not used*
  15       S1/SIO0        19
  16       SCLK           23

Note: The raspberry pi 3.3V rail should be sufficient to power the chip during
flashing, so no external power supply should be required; however, at the time
of writing that has only been tested and confirmed for one chip, the
MX25L6405D.

Macronix Spec sheet so you can adjust your pinout for 8 pin 4Mb chips as
necessary

![](images/rpi/0014.gif)

At this point connect your SOIC clip to the rom chip before powering on
your PI.

Power on your Pi, and run the following. Ensure you swap out
"your\_chip\_name" with the proper name/model of your chip. Check that
it can be read successfully. If you cannot read the chip and receive an
error similar to "no EEPROM Detected" or "0x0 Chip detected" then
you may want to try powering off your PI, and switching the two pins
which are connected to the IO ports. I.E. Connect pins (clip)8 to (pi)19
and pins (clip)15 to (pi)21

    pi# cd ~/flashrom

    pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 --chip <your_chip_name> -r romread1.rom

    pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 --chip <your_chip_name> -r romread2.rom

    pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 --chip <your_chip_name> -r romread3.rom

    pi# sha512sum romread*.rom

If they are identical sha512 hashes then you can generally assume that
it's safe to flash your rom.

    pi# ./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512 --chip <your_chip_name> -w libreboot.rom

It may fail a couple times, but keep at it and when you get the message
`Verifying flash... Verified` or
`Warning: Chip content is identical to the requested image` then you're
done.

Shut down your pi, put your box back together, and install a libre OS
for great good!

Raspberry Pi (C720 Chromebook)
-------------------------------

The Raspberry Pi (a multipurpose \$25 GNU+Linux computer) can be used as
a BIOS flashing tool, thanks to its GPIO pins and SPI support.

### [](#what-you-need){#user-content-what-you-need .anchor}What you need

-   \$25 - Raspberry Pi Model B (Rev.2 or higher)
-   \$10-20 - SOIC-8 Pomona Clip
    -   Usually comes bundled with nice, color-colored *female to
        female* wires

### [](#raspberry-pi-pinouts){#user-content-raspberry-pi-pinouts .anchor}Raspberry Pi Pinouts

GPIO Pinouts:

![](images/rpi/0009.png) ![](images/rpi/0010.png)

> \*Diagram made by ["Pacman" from Win-Raid
> Forums\*](http://www.win-raid.com/t58f16-Guide-Recover-from-failed-BIOS-flash-using-Raspberry-PI.md)

SOIC Pinouts:

![](docs/rpi/0011.png)

### [](#plugging-in-the-soic-clip){#user-content-plugging-in-the-soic-clip .anchor}Plugging in the SOIC Clip

We have to connect the Raspberry Pi to the SOIC Clip as shown in the
below diagram (using the f-f wires usually included with the Pomona
clip).

![SOIC Pinouts for C720 Chromebook](images/rpi/0003.png)

(C720 Only?) The diagram depicts a "bridged" connection. You will need
to fashion one with some copper wire:

![Bridged wires](images/rpi/0004.jpg)

Plug in the wires to the clip as shown below:

![Pomona Clip connections](images/rpi/0005.jpg)

Plug in the other end of the wires to the Raspberry Pi as shown below:

![Raspberry Pi connections](images/rpi/0006.jpg)

(C720 only?) Plug in the "bridged" wires as shown below:

![Bridged wires connected](images/rpi/0007.jpg)

Finally, put the Pomona SOIC clip on the chip:

![Pomona Clip Connected](images/rpi/0008.jpg)

### Flashrom

[Once it's all set up, flashrom works out of the
box.](http://www.flashrom.org/RaspberryPi)

### Sources

-   *Pomona SOIC Clip flashing*
    -   [Arch Linux Wiki - Installing Arch Linux on
        Chromebook](https://wiki.archlinux.org/index.php/Chromebook)
    -   [Google Drive - Raspberry Pi SOIC Clip
        connection](https://drive.google.com/folderview?id=0B9f62MH0umbmRTA2Xzd5WHhjWEU&usp=sharing)
    -   [rPI with Flashrom and SOIC Clip
        Powerpoint](http://satxhackers.org/wp/hack-content/uploads/2013/04/rPI_flashrom.pdf)
    -   [Tnhh - Unbricking Chromebook with
        Beaglebone](http://www.tnhh.net/2014/08/25/unbricking-chromebook-with-beaglebone.md)
-   *Use a DIY DIP System to flash an desoldered BIOS chip*
    -   [Viktak - How to recover laptop after failed BIOS
        flash](http://diy.viktak.com/2014/07/how-to-recover-laptop-after-failed-bios.md)
    -   [Win-Raid - Recover from Failed BIOS Flashing using Raspberry
        Pi](http://www.win-raid.com/t58f16-Guide-Recover-from-failed-BIOS-flash-using-Raspberry-PI.md)

Copyright © 2014, 2015 Lawrence Wu <sagnessagiel@gmail.com>\
Copyright © 2015 snuffeluffegus <>\
Copyright © 2015 Kevin Keijzer <>\
Copyright © 2016 Leah Rowe <info@minifree.org>\

This page is available under the [CC BY SA 4.0](../cc-by-sa-4.0.txt)


code:
---
title: Flashing the T400 with a BeagleBone Black
...

Initial flashing instructions for T400.

This guide is for those who want libreboot on their ThinkPad T400 while
they still have the original Lenovo BIOS present. This guide can also be
followed (adapted) if you brick your T400, to know how to recover.

An
["HMM"](https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/43y6629_05.pdf#page=386)
(Hardware Maintenance Manual) detailing the process of \[dis\]assembly
is available for this model. Be careful when reassembling the laptop as
the screws on page 144 (with title "1130 Keyboard bezel") are swapped
and if you follow the HMM you will punch a hole through the bezel in the
upper right corner.

Serial port {#serial_port}
-----------

EHCI debug might not be needed. It has been reported that the docking
station for this laptop has a serial port, so it might be possible to
use that instead.

A note about CPUs
=================

[ThinkWiki](http://www.thinkwiki.org/wiki/Category:T400) has a list of
CPUs for this system. The Core 2 Duo P8400, P8600 and P8700 are believed
to work in libreboot.

T9600, T9500 and T9550 are all compatible, as reported by users.

Quad-core CPUs
--------------

Incompatible. Do not use.

A note about GPUs
=================

Some models have an Intel GPU, while others have both an ATI and an
Intel GPU; this is referred to as "switchable graphics". In the *BIOS
setup* program for lenovobios, you can specify that the system will use
one or the other (but not both).

Libreboot is known to work on systems with only the Intel GPU, using
native graphics initialization. On systems with switchable graphics, the
Intel GPU is used and the ATI GPU is disabled, so native graphics
initialization works all the same.

CPU paste required
==================

See [\#paste](#paste).

Flash chip size {#flashchips}
===============

Use this to find out:

    # flashrom -p internal -V

MAC address {#macaddress}
===========

On the T400, the MAC address for the onboard gigabit ethernet chipset is
stored inside the flash chip, along with other configuration data.

Keep a note of the MAC address before disassembly; this is very
important, because you will need to insert this into the libreboot ROM
image before flashing it. It will be written in one of these locations:

![](images/t400/macaddress0.jpg) ![](images/t400/macaddress1.jpg)
![](images/x200/disassembly/0001.jpg)

Initial BBB configuration
=========================

Refer to [bbb\_setup.md](bbb_setup.md) for how to configure the BBB
for flashing.

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-16 (clip: Pomona 5252):

    POMONA 5252 (correlate with the BBB guide)
    ===  ethernet jack and VGA port ====
     NC              -       - 21
     1               -       - 17
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     18              -       - 3.3V (PSU)
     22              -       - NC - this is pin 1 on the flash chip
    ===  SATA port ===
    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-8 (clip: Pomona 5250):

    POMONA 5250 (correlate with the BBB guide)
    ===  RAM slots ====
     18              -       - 1
     22              -       - NC
     NC              -       - 21
     3.3V (PSU)      -       - 17 - this is pin 1 on the flash chip
    ===  slot where the AC jack is connected ===

    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

The procedure
-------------

Remove *all* screws, placing them in the order that you removed them:\
![](images/t400/0001.jpg) ![](images/t400/0002.jpg)

Remove those three screws then remove the rear bezel:\
![](images/t400/0003.jpg) ![](images/t400/0004.jpg)
![](images/t400/0005.jpg) ![](images/t400/0006.jpg)

Remove the speakers:\
![](images/t400/0007.jpg) ![](images/t400/0008.jpg)
![](images/t400/0009.jpg) ![](images/t400/0010.jpg)
![](images/t400/0011.jpg)

Remove the wifi:\
![](images/t400/0012.jpg) ![](images/t400/0013.jpg)

Remove this cable:\
![](images/t400/0014.jpg) ![](images/t400/0015.jpg)
![](images/t400/0016.jpg) ![](images/t400/0017.jpg)
![](images/t400/0018.jpg)

Unroute those antenna wires:\
![](images/t400/0019.jpg) ![](images/t400/0020.jpg)
![](images/t400/0021.jpg) ![](images/t400/0022.jpg)
![](images/t400/0023.jpg)

Remove the LCD assembly:\
![](images/t400/0024.jpg) ![](images/t400/0025.jpg)
![](images/t400/0026.jpg) ![](images/t400/0027.jpg)
![](images/t400/0028.jpg) ![](images/t400/0029.jpg)
![](images/t400/0030.jpg) ![](images/t400/0031.jpg)

Disconnect the NVRAM battery:\
![](images/t400/0033.jpg)

Disconnect the fan:\
![](images/t400/0034.jpg)

Unscrew these:\
![](images/t400/0035.jpg) ![](images/t400/0036.jpg)
![](images/t400/0037.jpg) ![](images/t400/0038.jpg)

Unscrew the heatsink, then lift it off:\
![](images/t400/0039.jpg) ![](images/t400/0040.jpg)

Disconnect the power jack:\
![](images/t400/0041.jpg) ![](images/t400/0042.jpg)

Loosen this:\
![](images/t400/0043.jpg)

Remove this:\
![](images/t400/0044.jpg) ![](images/t400/0045.jpg)
![](images/t400/0046.jpg) ![](images/t400/0047.jpg)
![](images/t400/0048.jpg)

Unscrew these:\
![](images/t400/0049.jpg) ![](images/t400/0050.jpg)

Remove this:\
![](images/t400/0051.jpg) ![](images/t400/0052.jpg)

Unscrew this:\
![](images/t400/0053.jpg)

Remove the motherboard (the cage is still attached) from the right hand
side, then lift it out:\
![](images/t400/0054.jpg) ![](images/t400/0055.jpg)
![](images/t400/0056.jpg)

Remove these screws, placing the screws in the same layout and marking
each screw hole (so that you know what ones to put the screws back into
later): ![](images/t400/0057.jpg) ![](images/t400/0058.jpg)
![](images/t400/0059.jpg) ![](images/t400/0060.jpg)
![](images/t400/0061.jpg) ![](images/t400/0062.jpg)

Separate the motherboard:\
![](images/t400/0063.jpg) ![](images/t400/0064.jpg)

Connect your programmer, then connect GND and 3.3V\
![](images/t400/0065.jpg) ![](images/t400/0066.jpg)
![](images/t400/0067.jpg) ![](images/t400/0069.jpg)
![](images/t400/0070.jpg) ![](images/t400/0071.jpg)

A dedicated 3.3V PSU was used to create this guide, but at ATX PSU is
also fine:\
![](images/t400/0072.jpg)

Of course, make sure to turn on your PSU:\
![](images/x200/disassembly/0013.jpg)

Now, you should be ready to install libreboot.

Flashrom binaries for ARM (tested on a BBB) are distributed in
libreboot\_util. Alternatively, libreboot also distributes flashrom
source code which can be built.

Log in as root on your BBB, using the instructions in
[bbb\_setup.html\#bbb\_access](bbb_setup.html#bbb_access).

Test that flashrom works:

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512

In this case, the output was:

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6406E/MX25L6436E" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6445E/MX25L6473E" (8192 kB, SPI) on linux_spi.
    Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)", "MX25L6406E/MX25L6436E", "MX25L6445E/MX25L6473E"
    Please specify which chip definition to use with the -c <chipname> option.

How to backup factory.rom (change the -c option as neeed, for your flash
chip):

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r

factory.rom

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r

factory1.rom

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r

factory2.rom

Note: the `-c` option is not required in libreboot's patched flashrom, because
the redundant flash chip definitions in `flashchips.c` have been removed.

Now compare the 3 images:

    # sha512sum factory*.rom

If the hashes match, then just copy one of them (the factory.rom) to a
safe place (on a drive connected to another system, not the BBB). This
is useful for reverse engineering work, if there is a desirable
behaviour in the original firmware that could be replicated in coreboot
and libreboot.

Follow the instructions at
[../hardware/gm45\_remove\_me.html\#ich9gen](../hardware/gm45_remove_me.html#ich9gen)
to change the MAC address inside the libreboot ROM image, before
flashing it. Although there is a default MAC address inside the ROM
image, this is not what you want. *Make sure to always change the MAC
address to one that is correct for your system.*

Now flash it:

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -w

path/to/libreboot/rom/image.rom -V

![](images/x200/disassembly/0015.jpg)

You might see errors, but if it says `Verifying flash... VERIFIED` at
the end, then it's flashed and should boot. If you see errors, try
again (and again, and again); the message `Chip content is identical to
the requested image` is also an indication of a successful
installation.

Example output from running the command (see above):

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Reading old flash chip contents... done.
    Erasing and writing flash chip... FAILED at 0x00001000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x0000ffff: 0xd716
    ERASE FAILED!
    Reading current flash chip contents... done. Looking for another erase function.
    Erase/write done.
    Verifying flash... VERIFIED.

Thermal paste (IMPORTANT)
=========================

Because part of this procedure involved removing the heatsink, you will
need to apply new paste. Arctic MX-4 is ok. You will also need isopropyl
alcohol and an anti-static cloth to clean with.

When re-installing the heatsink, you must first clean off all old paste
with the alcohol/cloth. Then apply new paste. Arctic MX-4 is also much
better than the default paste used on these systems.

![](images/t400/paste.jpg)

NOTE: the photo above is for illustration purposes only, and does not
show how to properly apply the thermal paste. Other guides online detail
the proper application procedure.

Wifi
====

The T400 typically comes with an Intel wifi chipset, which does not work
without proprietary software. For a list of wifi chipsets that work
without proprietary software, see
[../hardware/\#recommended\_wifi](../hardware/#recommended_wifi).

Some T400 laptops might come with an Atheros chipset, but this is
802.11g only.

It is recommended that you install a new wifi chipset. This can only be
done after installing libreboot, because the original firmware has a
whitelist of approved chips, and it will refuse to boot if you use an
'unauthorized' wifi card.

The following photos show an Atheros AR5B95 being installed, to replace
the Intel chip that this T400 came with:\
![](images/t400/0012.jpg) ![](images/t400/ar5b95.jpg)

WWAN
====

If you have a WWAN/3G card and/or sim card reader, remove them
permanently. The WWAN-3G card has proprietary firmware inside; the
technology is identical to what is used in mobile phones, so it can also
track your movements.

Not to be confused with wifi (wifi is fine).

Memory
======

You need DDR3 SODIMM PC3-8500 RAM installed, in matching pairs
(speed/size). Non-matching pairs won't work. You can also install a
single module (meaning, one of the slots will be empty) in slot 0.

Make sure that the RAM you buy is the 2Rx8 density.

[This page](http://www.forum.thinkpads.com/viewtopic.php?p=760721) might
be useful for RAM compatibility info (note: coreboot raminit is
different, so this page might be BS)

The following photo shows 8GiB (2x4GiB) of RAM installed:\
![](images/t400/memory.jpg)

Boot it!
--------

You should see something like this:

![](images/t400/boot0.jpg) ![](images/t400/boot1.jpg)

Now [install GNU+Linux](../gnulinux/).

Copyright © 2015 Leah Rowe <info@minifree.org>\

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License Version 1.3 or any later
version published by the Free Software Foundation
with no Invariant Sections, no Front Cover Texts, and no Back Cover Texts.
A copy of this license is found in [../fdl-1.3.md](../fdl-1.3.md)


code:
---
title: Flashing the T500 with a BeagleBone Black
...

Initial flashing instructions for T500.

This guide is for those who want libreboot on their ThinkPad T500 while
they still have the original Lenovo BIOS present. This guide can also be
followed (adapted) if you brick your T500, to know how to recover.

W500 is also mostly compatible with this guide.

Libreboot T400 {#t400}
==============

You may also be interested in the smaller, more portable [Libreboot
T400](t400_external.md).

Serial port {#serial_port}
-----------

EHCI debug might not be needed. It has been reported that the docking
station for this laptop has a serial port, so it might be possible to
use that instead.

A note about CPUs
=================

[ThinkWiki](http://www.thinkwiki.org/wiki/Category:T500) has a list of
CPUs for this system. The Core 2 Duo P8400, P8600 and P8700 are believed
to work in libreboot. The T9600 was also tested on the T400 and
confirmed working.

T9550 was tested by a user, and is compatible as reported in the IRC channel.
T9500 and T9400 may also work, but YMMV.

Quad-core CPUs
--------------

Incompatible. Do not use.

A note about GPUs
=================

Some models have an Intel GPU, while others have both an ATI and an
Intel GPU; this is referred to as "switchable graphics". In the *BIOS
setup* program for lenovobios, you can specify that the system will use
one or the other (but not both).

Libreboot is known to work on systems with only the Intel GPU, using
native graphics initialization. On systems with switchable graphics, the
Intel GPU is used and the ATI GPU is disabled, so native graphics
initialization works all the same.

CPU paste required
==================

See [\#paste](#paste).

Flash chip size {#flashchips}
===============

Use this to find out:

    # flashrom -p internal -V

MAC address {#macaddress}
===========

On the T500, the MAC address for the onboard gigabit ethernet chipset is
stored inside the flash chip, along with other configuration data.

Keep a note of the MAC address before disassembly; this is very
important, because you will need to insert this into the libreboot ROM
image before flashing it. It will be written in one of these locations:

![](images/t400/macaddress0.jpg) ![](images/t400/macaddress1.jpg)
![](images/x200/disassembly/0001.jpg)

Initial BBB configuration
=========================

Refer to [bbb\_setup.md](bbb_setup.md) for how to configure the BBB
for flashing.

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-16 (clip: Pomona 5252):

    POMONA 5252 (correlate with the BBB guide)
    ===  ethernet jack and VGA port ====
     NC              -       - 21
     1               -       - 17
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     NC              -       - NC
     18              -       - 3.3V (PSU)
     22              -       - NC - this is pin 1 on the flash chip
    ===  SATA port ===
    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

The following shows how to connect clip to the BBB (on the P9 header),
for SOIC-8 (clip: Pomona 5250):

    POMONA 5250 (correlate with the BBB guide)
    ===  RAM slots ====
     18              -       - 1
     22              -       - NC
     NC              -       - 21
     3.3V (PSU)      -       - 17 - this is pin 1 on the flash chip
    ===  slot where the AC jack is connected ===

    This is how you will connect. Numbers refer to pin numbers on the BBB, on the plugs near the DC jack.

The procedure
-------------

Remove all screws:\
![](images/t500/0000.jpg)\
It is also advisable to, throughout the disassembly, place any screws
and/or components that you removed in the same layout or arrangement.
The follow photos demonstrate this:\
![](images/t500/0001.jpg) ![](images/t500/0002.jpg)

Remove the HDD/SSD and optical drive:\
![](images/t500/0003.jpg) ![](images/t500/0004.jpg)

Remove the palm rest:\
![](images/t500/0005.jpg) ![](images/t500/0006.jpg)

Remove the keyboard and rear bezel:\
![](images/t500/0007.jpg) ![](images/t500/0008.jpg)
![](images/t500/0009.jpg) ![](images/t500/0010.jpg)
![](images/t500/0011.jpg) ![](images/t500/0012.jpg)

If you have a WWAN/3G card and/or sim card reader, remove them
permanently. The WWAN-3G card has proprietary firmware inside; the
technology is identical to what is used in mobile phones, so it can also
track your movements:\
![](images/t500/0013.jpg) ![](images/t500/0017.jpg)
![](images/t500/0018.jpg)

Remove this frame, and then remove the wifi chip:\
![](images/t500/0014.jpg) ![](images/t500/0015.jpg)
![](images/t500/0016.jpg)

Remove the speakers:\
![](images/t500/0019.jpg) ![](images/t500/0020.jpg)
![](images/t500/0021.jpg) ![](images/t500/0022.jpg)
![](images/t500/0023.jpg) ![](images/t500/0024.jpg)
![](images/t500/0025.jpg)

Remove the NVRAM battery (already removed in this photo):\
![](images/t500/0026.jpg)

When you re-assemble, you will be replacing the wifi chip with another.
These two screws don't hold anything together, but they are included in
your system because the screw holes for half-height cards are a
different size, so use these if you will be installing a half-height
card:\
![](images/t500/0027.jpg)

Unroute the antenna wires:\
![](images/t500/0028.jpg) ![](images/t500/0029.jpg)
![](images/t500/0030.jpg) ![](images/t500/0031.jpg)

Disconnect the LCD cable from the motherboard:\
![](images/t500/0032.jpg) ![](images/t500/0033.jpg)

Remove the LCD assembly hinge screws, and then remove the LCD assembly:\
![](images/t500/0034.jpg) ![](images/t500/0035.jpg)
![](images/t500/0036.jpg)

Remove the fan and heatsink:\
![](images/t500/0037.jpg) ![](images/t500/0038.jpg)
![](images/t500/0039.jpg)

Remove this screw:\
![](images/t500/0040.jpg)

Remove these cables, keeping note of how and in what arrangement they
are connected:\
![](images/t500/0041.jpg) ![](images/t500/0042.jpg)
![](images/t500/0043.jpg) ![](images/t500/0044.jpg)
![](images/t500/0045.jpg) ![](images/t500/0046.jpg)
![](images/t500/0047.jpg) ![](images/t500/0048.jpg)
![](images/t500/0049.jpg)

Disconnect the power jack:\
![](images/t500/0050.jpg) ![](images/t500/0051.jpg)

Remove the motherboard and cage from the base (the marked hole is where
those cables were routed through):\
![](images/t500/0052.jpg) ![](images/t500/0053.jpg)

Remove all screws, arranging them in the same layout when placing the
screws on a surface and marking each screw hole (this is to reduce the
possibility of putting them back in the wrong holes):\
![](images/t500/0054.jpg) ![](images/t500/0055.jpg)

Also remove this:\
![](images/t500/0056.jpg) ![](images/t500/0057.jpg)

Separate the motherboard from the cage:\
![](images/t500/0058.jpg) ![](images/t500/0059.jpg)

The flash chip is next to the memory slots. On this system, it was a
SOIC-8 (4MiB or 32Mb) flash chip:\
![](images/t500/0060.jpg)

Connect your programmer, then connect GND and 3.3V\
![](images/t500/0061.jpg)\
![](images/t400/0067.jpg) ![](images/t400/0069.jpg)
![](images/t400/0070.jpg) ![](images/t400/0071.jpg)

A dedicated 3.3V PSU was used to create this guide, but at ATX PSU is
also fine:\
![](images/t400/0072.jpg)

Of course, make sure to turn on your PSU:\
![](images/x200/disassembly/0013.jpg)

Now, you should be ready to install libreboot.

Flashrom binaries for ARM (tested on a BBB) are distributed in
libreboot\_util. Alternatively, libreboot also distributes flashrom
source code which can be built.

Log in as root on your BBB, using the instructions in
[bbb\_setup.html\#bbb\_access](bbb_setup.html#bbb_access).

Test that flashrom works:

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512

In this case, the output was:

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6406E/MX25L6436E" (8192 kB, SPI) on linux_spi.
    Found Macronix flash chip "MX25L6445E/MX25L6473E" (8192 kB, SPI) on linux_spi.
    Multiple flash chip definitions match the detected chip(s): "MX25L6405(D)", "MX25L6406E/MX25L6436E", "MX25L6445E/MX25L6473E"
    Please specify which chip definition to use with the -c <chipname> option.

How to backup factory.rom (change the -c option as neeed, for your flash
chip):

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r

factory.rom

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r

factory1.rom

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -r

factory2.rom

Note: the `-c` option is not required in libreboot's patched
flashrom, because the redundant flash chip definitions in *flashchips.c*
have been removed.\
Now compare the 3 images:

    # sha512sum factory\*.rom

If the hashes match, then just copy one of them (the factory.rom) to a
safe place (on a drive connected to another system, not the BBB). This
is useful for reverse engineering work, if there is a desirable
behaviour in the original firmware that could be replicated in coreboot
and libreboot.

Follow the instructions at
[../hardware/gm45\_remove\_me.html\#ich9gen](../hardware/gm45_remove_me.html#ich9gen)
to change the MAC address inside the libreboot ROM image, before
flashing it. Although there is a default MAC address inside the ROM
image, this is not what you want. *Make sure to always change the MAC
address to one that is correct for your system.*

Now flash it:

    # ./flashrom -p linux_spi:dev=/dev/spidev1.0,spispeed=512 -w

path/to/libreboot/rom/image.rom -V

![](images/x200/disassembly/0015.jpg)

You might see errors, but if it says `Verifying flash... VERIFIED` at
the end, then it's flashed and should boot. If you see errors, try
again (and again, and again); the message `Chip content is identical to
the requested image` is also an indication of a successful
installation.

Example output from running the command (see above):

    flashrom v0.9.7-r1854 on Linux 3.8.13-bone47 (armv7l)
    flashrom is free software, get the source code at http://www.flashrom.org
    Calibrating delay loop... OK.
    Found Macronix flash chip "MX25L6405(D)" (8192 kB, SPI) on linux_spi.
    Reading old flash chip contents... done.
    Erasing and writing flash chip... FAILED at 0x00001000! Expected=0xff, Found=0x00, failed byte count from 0x00000000-0x0000ffff: 0xd716
    ERASE FAILED!
    Reading current flash chip contents... done. Looking for another erase function.
    Erase/write done.
    Verifying flash... VERIFIED.

Thermal paste (IMPORTANT)
=========================

Because part of this procedure involved removing the heatsink, you will
need to apply new paste. Arctic MX-4 is ok. You will also need isopropyl
alcohol and an anti-static cloth to clean with.

When re-installing the heatsink, you must first clean off all old paste
with the alcohol/cloth. Then apply new paste. Arctic MX-4 is also much
better than the default paste used on these systems.

![](images/t400/paste.jpg)

NOTE: the photo above is for illustration purposes only, and does not
show how to properly apply the thermal paste. Other guides online detail
the proper application procedure.

Wifi
====

The T500 typically comes with an Intel wifi chipset, which does not work
without proprietary software. For a list of wifi chipsets that work
without proprietary software, see
[../hardware/\#recommended\_wifi](../hardware/#recommended_wifi).

Some T500 laptops might come with an Atheros chipset, but this is
802.11g only.

It is recommended that you install a new wifi chipset. This can only be
done after installing libreboot, because the original firmware has a
whitelist of approved chips, and it will refuse to boot if you use an
'unauthorized' wifi card.

The following photos show an Atheros AR5B95 being installed, to replace
the Intel chip that this T500 came with:\
![](images/t400/0012.jpg) ![](images/t400/ar5b95.jpg)

WWAN
====

If you have a WWAN/3G card and/or sim card reader, remove them
permanently. The WWAN-3G card has DMA, and proprietary firmware inside;
the technology is identical to what is used in mobile phones, so it can
also track your movements.

Not to be confused with wifi (wifi is fine).

Memory
======

You need DDR3 SODIMM PC3-8500 RAM installed, in matching pairs
(speed/size). Non-matching pairs won't work. You can also install a
single module (meaning, one of the slots will be empty) in slot 0.

Make sure that the RAM you buy is the 2Rx8 density.

[This page](http://www.forum.thinkpads.com/viewtopic.php?p=760721) might
be useful for RAM compatibility info (note: coreboot raminit is
different, so this page might be BS)

The following photo shows 8GiB (2x4GiB) of RAM installed:\
![](images/t400/memory.jpg)

Boot it!
--------

You should see something like this:

![](images/t500/0062.jpg)

Now [install GNU+Linux](../gnulinux/).

Copyright © 2015 Leah Rowe <info@minifree.org>\

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License Version 1.3 or any later
version published by the Free Software Foundation
with no Invariant Sections, no Front Cover Texts, and no Back Cover Texts.
A copy of this license is found in [../fdl-1.3.md](../fdl-1.3.md)