From 488242eb941305ef61319b8499d4a1e8ccf218a1 Mon Sep 17 00:00:00 2001
From: Francis Rowe
Date: Sun, 20 Jul 2014 07:37:00 +0000
Subject: Libreboot release 6 beta 3.
- Fixed typo that existed in 2nd beta where the release date of the
2nd beta was listed as being in year 2016, when in actual fact it
was 2014.
- Documentation: added (preliminary) details about (rare) buggy CPU's
on the ThinkPad T60 that were found to fail (instability, kernel
panics, etc) without the microcode updates.
- Documentation: added docs/howtos/x60_heatsink.html for showing how
to change the heatsink on the Thinkpad X60
- Added ROM images for Azerty (French) keyboard layout in GRUB
(courtesy of Olivier Mondoloni)
- Tidied up some scripts:
- Re-factored those scripts (made easier to read/maintain):
build-x60, build-x60t, build-t60, build-macbook21
- Reduced the number of grub configs to 2 (or 1, for macbook21), the
build scripts now generate the other configs at build time.
- Deleted build-x60, build-x60t, build-t60, build-macbook21 and
replaced with intelligent (generic) buildrom-withgrub script
- Updated build to use buildrom-withgrub script for building the ROM
images.
- coreboot.rom and coreboot_serial.rom renamed to
coreboot_usqwerty.rom and coreboot_serial_usqwerty.rom
- coreboot_dvorak and coreboot_serial_dvorak.rom renamed to
coreboot_usdvorak.rom and coreboot_serial_usdvorak.rom
- Renamed coreboot*rom to libreboot*rom
- Made flash, lenovobios_firstflash and lenovobios_secondflash
scripts fail if the specified file does not exist.
- Updated all relevant parts of the documentation to reflect the
above.
- Replaced background.png with background.jpg. added
gnulove.jpg. (resources/grub/background/)
- Updated buildrom-withgrub to use background.jpg instead of
background.png
- Updated buildrom-withgrub to use gnulove.jpg aswell
- Updated resources/grub/config/macbook21/grub*cfg to use gnulove.jpg
background.
- Updated resources/grub/config/{x60,t60,x60t}/grub*cfg to use
background.jpg background.
- Documentation: updated docs/index.html#grub_custom_keyboard to be
more generally useful.
- nvramtool:
- Updated builddeps-coreboot script to build it
- Updated build script to include it in libreboot_bin
- Documentation: added docs/howtos/x60_security.html (security
hardening for X60)
---
docs/howtos/grub_cbfs.html | 26 ++--
docs/howtos/x60_heatsink.html | 142 ++++++++++++++++++++++
docs/howtos/x60_heatsink/0000.jpg | Bin 0 -> 53772 bytes
docs/howtos/x60_heatsink/0001.jpg | Bin 0 -> 38997 bytes
docs/howtos/x60_heatsink/0002.jpg | Bin 0 -> 31435 bytes
docs/howtos/x60_heatsink/0003.jpg | Bin 0 -> 29815 bytes
docs/howtos/x60_heatsink/0004.jpg | Bin 0 -> 42084 bytes
docs/howtos/x60_heatsink/0005.jpg | Bin 0 -> 42715 bytes
docs/howtos/x60_heatsink/0006.jpg | Bin 0 -> 33748 bytes
docs/howtos/x60_heatsink/0007.jpg | Bin 0 -> 45537 bytes
docs/howtos/x60_heatsink/0008.jpg | Bin 0 -> 46045 bytes
docs/howtos/x60_heatsink/0009.jpg | Bin 0 -> 34013 bytes
docs/howtos/x60_heatsink/0010.jpg | Bin 0 -> 30985 bytes
docs/howtos/x60_heatsink/0011.jpg | Bin 0 -> 45500 bytes
docs/howtos/x60_heatsink/0012.jpg | Bin 0 -> 39202 bytes
docs/howtos/x60_heatsink/0013.jpg | Bin 0 -> 45481 bytes
docs/howtos/x60_heatsink/0014.jpg | Bin 0 -> 40388 bytes
docs/howtos/x60_heatsink/0015.jpg | Bin 0 -> 38045 bytes
docs/howtos/x60_heatsink/0016.jpg | Bin 0 -> 125147 bytes
docs/howtos/x60_heatsink/0017.jpg | Bin 0 -> 143009 bytes
docs/howtos/x60_heatsink/0018.jpg | Bin 0 -> 175369 bytes
docs/howtos/x60_security.html | 171 +++++++++++++++++++++++++++
docs/howtos/x60_security/0000.jpg | Bin 0 -> 53772 bytes
docs/howtos/x60_security/0000_bluetooth.jpg | Bin 0 -> 120337 bytes
docs/howtos/x60_security/0000_bluetooth0.jpg | Bin 0 -> 19558 bytes
docs/howtos/x60_security/0000_simcard0.jpg | Bin 0 -> 105696 bytes
docs/howtos/x60_security/0000_simcard1.jpg | Bin 0 -> 129884 bytes
docs/howtos/x60_security/0001.jpg | Bin 0 -> 38997 bytes
docs/howtos/x60_security/0001_microphone.jpg | Bin 0 -> 128637 bytes
docs/howtos/x60_security/0001_modem.jpg | Bin 0 -> 124855 bytes
docs/howtos/x60_security/0001_overview.jpg | Bin 0 -> 200563 bytes
docs/howtos/x60_security/0001_speaker.jpg | Bin 0 -> 121336 bytes
docs/howtos/x60_security/0001_wlan_wwan.jpg | Bin 0 -> 151989 bytes
docs/howtos/x60_security/0002.jpg | Bin 0 -> 31435 bytes
docs/howtos/x60_security/0003.jpg | Bin 0 -> 29815 bytes
docs/howtos/x60_security/0004.jpg | Bin 0 -> 42084 bytes
docs/howtos/x60_unbrick.html | 3 +-
37 files changed, 328 insertions(+), 14 deletions(-)
create mode 100644 docs/howtos/x60_heatsink.html
create mode 100644 docs/howtos/x60_heatsink/0000.jpg
create mode 100644 docs/howtos/x60_heatsink/0001.jpg
create mode 100644 docs/howtos/x60_heatsink/0002.jpg
create mode 100644 docs/howtos/x60_heatsink/0003.jpg
create mode 100644 docs/howtos/x60_heatsink/0004.jpg
create mode 100644 docs/howtos/x60_heatsink/0005.jpg
create mode 100644 docs/howtos/x60_heatsink/0006.jpg
create mode 100644 docs/howtos/x60_heatsink/0007.jpg
create mode 100644 docs/howtos/x60_heatsink/0008.jpg
create mode 100644 docs/howtos/x60_heatsink/0009.jpg
create mode 100644 docs/howtos/x60_heatsink/0010.jpg
create mode 100644 docs/howtos/x60_heatsink/0011.jpg
create mode 100644 docs/howtos/x60_heatsink/0012.jpg
create mode 100644 docs/howtos/x60_heatsink/0013.jpg
create mode 100644 docs/howtos/x60_heatsink/0014.jpg
create mode 100644 docs/howtos/x60_heatsink/0015.jpg
create mode 100644 docs/howtos/x60_heatsink/0016.jpg
create mode 100644 docs/howtos/x60_heatsink/0017.jpg
create mode 100644 docs/howtos/x60_heatsink/0018.jpg
create mode 100644 docs/howtos/x60_security.html
create mode 100644 docs/howtos/x60_security/0000.jpg
create mode 100644 docs/howtos/x60_security/0000_bluetooth.jpg
create mode 100644 docs/howtos/x60_security/0000_bluetooth0.jpg
create mode 100644 docs/howtos/x60_security/0000_simcard0.jpg
create mode 100644 docs/howtos/x60_security/0000_simcard1.jpg
create mode 100644 docs/howtos/x60_security/0001.jpg
create mode 100644 docs/howtos/x60_security/0001_microphone.jpg
create mode 100644 docs/howtos/x60_security/0001_modem.jpg
create mode 100644 docs/howtos/x60_security/0001_overview.jpg
create mode 100644 docs/howtos/x60_security/0001_speaker.jpg
create mode 100644 docs/howtos/x60_security/0001_wlan_wwan.jpg
create mode 100644 docs/howtos/x60_security/0002.jpg
create mode 100644 docs/howtos/x60_security/0003.jpg
create mode 100644 docs/howtos/x60_security/0004.jpg
(limited to 'docs/howtos')
diff --git a/docs/howtos/grub_cbfs.html b/docs/howtos/grub_cbfs.html
index 84466866..d95904d0 100644
--- a/docs/howtos/grub_cbfs.html
+++ b/docs/howtos/grub_cbfs.html
@@ -29,7 +29,7 @@
- A coreboot or libreboot ROM is not simply "flat"; there is an actual filesystem inside called CBFS (coreboot filesystem). A utility called 'cbfstool'
+ A libreboot (or coreboot) ROM is not simply "flat"; there is an actual filesystem inside called CBFS (coreboot filesystem). A utility called 'cbfstool'
allows you to change the contents of the ROM. In this case, libreboot is configured such that the grub.cfg exists directly inside CBFS instead of
inside the grub.elf payload's 'memdisk' (which is itself stored in CBFS).
@@ -61,30 +61,30 @@
You can work directly with one of the ROM's already included in libreboot_bin.tar.gz. For the purpose of this tutorial it is assumed
- that your ROM is named 'coreboot.rom' so please make sure to adapt.
+ that your ROM is named 'libreboot_usqwerty.rom' so please make sure to adapt.
If you want to re-use the ROM that you currently have flashed (and running) then see ../index.html#build_flashrom
and then run:
- $ sudo ./flashrom -p internal -r coreboot.rom
- Notice that this is using "-r" (read) instead of "-w" (write). This will create a dump (copy) of your current firmware and name it coreboot.rom. You need to take ownership of the file. For example:
- $ sudo chown yourusername:yourusername coreboot.rom
- # chown yourusername:yourusername coreboot.rom
+ $ sudo ./flashrom -p internal -r libreboot_usqwerty.rom
+ Notice that this is using "-r" (read) instead of "-w" (write). This will create a dump (copy) of your current firmware and name it libreboot_usqwerty.rom. You need to take ownership of the file. For example:
+ $ sudo chown yourusername:yourusername libreboot_usqwerty.rom
+ # chown yourusername:yourusername libreboot_usqwerty.rom
Delete the grub.cfg that remained inside the ROM:
- $ ./cbfstool coreboot.rom remove -n grub.cfg
+ $ ./cbfstool libreboot_usqwerty.rom remove -n grub.cfg
Display ROM contents and now you see grub.cfg no longer exists there:
- $ ./cbfstool coreboot.rom print
+ $ ./cbfstool libreboot_usqwerty.rom print
Add the modified version that you just made:
- $ ./cbfstool coreboot.rom add -n grub.cfg -f grub.cfg -t raw
+ $ ./cbfstool libreboot_usqwerty.rom add -n grub.cfg -f grub.cfg -t raw
Now display ROM contents again and see that it exists again:
- $ ./cbfstool coreboot.rom print
+ $ ./cbfstool libreboot_usqwerty.rom print
isopropyl alcholal (sometimes called rubbing alchole) (cleaning material. DoNotIngest) (typo is intentional, due to fii1illterii1iiing für wörten von Großbritannien und oder nationale iintturnett)
+
your new fan and/or heatsink
+
CPU thermal compound (some say Arctic Silver 5 or IC Diamond 7 are good, others are also 'ok')
+
Something to spread the paste with
+
+
+
Software requirements (for CPU stress testing)
+
+
xsensors utility
+
stress utility
+
+
+
Disassembly
+
+ Remove those screws:
+
+
+
+ Push the keyboard forward (carefully):
+
+
+
+ Lift the keyboard up and disconnect it from the board:
+
+
+
+ Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:
+
+
+
+ You should now have this:
+
+
+
+ Disconnect the wifi antenna cables, the modem cable and the speaker:
+
+
+
+ Unroute the cables along their path, carefully lifting the tape that holds them in place. Then, disconnect the modem
+ cable (other end) and power connection and unroute all the cables so that they dangle by the monitor hinge on the right-hand
+ side:
+
+
+
+ Disconnect the monitor from the motherboard, and unroute the grey antenna cable, carefully lifting the tape
+ that holds it into place:
+
+
+
+ Carefully lift the remaining tape and unroute the left antenna cable so that it is loose:
+
+
+
+ Remove those screws:
+
+
+
+ Remove those screws:
+
+
+
+ Carefully remove the plate, like so:
+
+
+
+ Remove the SATA connector:
+
+
+
+ Now remove the motherboard (gently) and cast the lcd/chassis aside:
+
+
+
+ Look at that black tape above the heatsink, remove it:
+
+
+
+ Now you have removed it:
+
+
+
+
+ Disconnect the fan and remove all the screws, heatsink will easily come off:
+
+
+
+
+ Remove the old paste with a cloth (from the CPU and heatsink) and then clean both of them with the alcholeel (to remove remaining residue. typo is intentional).
+ Apply a pea-sized amount of paste to the both chipsets that the heatsink covered and spread it evenly (uniformally).
+ Finally reinstall the heatsink, reversing previous steps.
+
+
+
+ stress -c 2 command can be used to push the CPU to 100%, and xsensors (or watch sensors command) can be used to monitor heat.
+ Below 90C is ok.
+
(in a later version of this tutorial: soldering iron and scalpel)
+
+
+
Software requirements
+
+
none (at least in the scope of the article as-is)
+
+
+
Disassembly
+
+
+ Firstly remove the bluetooth (if your X60 has this):
+ The marked screws are underneath those stickers (marked in those 3 locations at the bottom of the LCD assembly):
+
+ Now gently pry off the bottom part of the front bezel, and the bluetooth module is on the left (easily removable):
+
+
+
+
+ If your model was WWAN, remove the simcard (check anyway):
+ Uncover those 2 screws at the bottom:
+
+ SIM card is in the marked location:
+
+ Replacement: USB dongle.
+
+
+
+ Now get into the motherboard.
+
+
+
+ Remove those screws:
+
+
+
+ Push the keyboard forward (carefully):
+
+
+
+ Lift the keyboard up and disconnect it from the board:
+
+
+
+ Grab the right-hand side of the chassis and force it off (gently) and pry up the rest of the chassis:
+
+
+
+ You should now have this:
+
+
+
+
+ The following is a summary of what you will remove (already done to this machine):
+
+ Note: the blue lines represent antenna cables and modem cables. You don't need to remove these, but you can if you want
+ (to make it tidier after removing other parts). I removed the antenna wires, the modem jack, the modem cable and
+ also (on another model) a device inside the part where the wwan antenna goes (wasn't sure what it was, but I knew it wasn't needed). This is optional
+
+
+
+ Remove the microphone (can desolder it, but you can also easily pull it off with you hands). Already removed here:
+
+ We do not know what the built-in microcode (on the CPU) is doing. The theory is that it could be programmed to take commands that do something
+ and then the CPU returns results. (meaning, remote security hole). So we remove it, just in case.
+ Replacement: external microphone on USB or line-in jack.
+
+
+
+ Remove the modem:
+
+ (useless, obsolete device)
+
+
+
+ Remove the speaker:
+
+ Reason: combined with the microphone issue, this could be used to leak data.
+ Replacement: headphones/speakers (line-out) or external DAC (USB).
+
+
+
+ Remove the wlan (also remove wwan if you have it):
+
+ Reason: has direct (and very fast) memory access, and could (theoretically) leak data over a side-channel.
+
+
+
+
diff --git a/docs/howtos/x60_security/0000.jpg b/docs/howtos/x60_security/0000.jpg
new file mode 100644
index 00000000..ce0ec3be
Binary files /dev/null and b/docs/howtos/x60_security/0000.jpg differ
diff --git a/docs/howtos/x60_security/0000_bluetooth.jpg b/docs/howtos/x60_security/0000_bluetooth.jpg
new file mode 100644
index 00000000..94a255ff
Binary files /dev/null and b/docs/howtos/x60_security/0000_bluetooth.jpg differ
diff --git a/docs/howtos/x60_security/0000_bluetooth0.jpg b/docs/howtos/x60_security/0000_bluetooth0.jpg
new file mode 100644
index 00000000..a750b0cd
Binary files /dev/null and b/docs/howtos/x60_security/0000_bluetooth0.jpg differ
diff --git a/docs/howtos/x60_security/0000_simcard0.jpg b/docs/howtos/x60_security/0000_simcard0.jpg
new file mode 100644
index 00000000..40837ea7
Binary files /dev/null and b/docs/howtos/x60_security/0000_simcard0.jpg differ
diff --git a/docs/howtos/x60_security/0000_simcard1.jpg b/docs/howtos/x60_security/0000_simcard1.jpg
new file mode 100644
index 00000000..c0a5b359
Binary files /dev/null and b/docs/howtos/x60_security/0000_simcard1.jpg differ
diff --git a/docs/howtos/x60_security/0001.jpg b/docs/howtos/x60_security/0001.jpg
new file mode 100644
index 00000000..2bbc0cae
Binary files /dev/null and b/docs/howtos/x60_security/0001.jpg differ
diff --git a/docs/howtos/x60_security/0001_microphone.jpg b/docs/howtos/x60_security/0001_microphone.jpg
new file mode 100644
index 00000000..c419060d
Binary files /dev/null and b/docs/howtos/x60_security/0001_microphone.jpg differ
diff --git a/docs/howtos/x60_security/0001_modem.jpg b/docs/howtos/x60_security/0001_modem.jpg
new file mode 100644
index 00000000..6a7a6a02
Binary files /dev/null and b/docs/howtos/x60_security/0001_modem.jpg differ
diff --git a/docs/howtos/x60_security/0001_overview.jpg b/docs/howtos/x60_security/0001_overview.jpg
new file mode 100644
index 00000000..7268e49f
Binary files /dev/null and b/docs/howtos/x60_security/0001_overview.jpg differ
diff --git a/docs/howtos/x60_security/0001_speaker.jpg b/docs/howtos/x60_security/0001_speaker.jpg
new file mode 100644
index 00000000..28d3ed62
Binary files /dev/null and b/docs/howtos/x60_security/0001_speaker.jpg differ
diff --git a/docs/howtos/x60_security/0001_wlan_wwan.jpg b/docs/howtos/x60_security/0001_wlan_wwan.jpg
new file mode 100644
index 00000000..0db858de
Binary files /dev/null and b/docs/howtos/x60_security/0001_wlan_wwan.jpg differ
diff --git a/docs/howtos/x60_security/0002.jpg b/docs/howtos/x60_security/0002.jpg
new file mode 100644
index 00000000..b55db3b8
Binary files /dev/null and b/docs/howtos/x60_security/0002.jpg differ
diff --git a/docs/howtos/x60_security/0003.jpg b/docs/howtos/x60_security/0003.jpg
new file mode 100644
index 00000000..c5799ae5
Binary files /dev/null and b/docs/howtos/x60_security/0003.jpg differ
diff --git a/docs/howtos/x60_security/0004.jpg b/docs/howtos/x60_security/0004.jpg
new file mode 100644
index 00000000..cd47840d
Binary files /dev/null and b/docs/howtos/x60_security/0004.jpg differ
diff --git a/docs/howtos/x60_unbrick.html b/docs/howtos/x60_unbrick.html
index 10f66b4d..8427c5ac 100644
--- a/docs/howtos/x60_unbrick.html
+++ b/docs/howtos/x60_unbrick.html
@@ -172,7 +172,8 @@
Programmer is now active:
Now I install flashrom on the T60 (running Trisquel GNU/Linux) and do this:
- flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -w coreboot.rom
+ flashrom -p buspirate_spi:dev=/dev/ttyUSB0 -w bin/x60/libreboot_usqwerty.rom
+ Note: there are also other ROM images for X60
Note: this is using buspirate as the programmer, so it is flashing the X60, not the T60!
Here's my terminal window on the T60:
--
cgit v1.2.3-70-g09d2