Installing classic keyboard into X230 with EC firmware mod

[nitrocaster]

Do you think this method could generalise to newer Thinkpads than the xx30 generation, or is the way they handle keyboards too different?

Newer ThinkPad models use completely new keyboard, including connector.

[hamish]

I've looked at the firmware for three of the xx30 generation laptops, and I was able to find the right keyboard data in all three cases, so I am hoping that it just as straight-forward to apply the same process to others in that generation.

See http://www.thinkwiki.org/wiki/Install_C ... r_Firmware for the current list of firmware I have looked at

Sorry, I meant the generations that are still newer (xx40~xx60, or perhaps even the Yoga 260 for an actual digitiser machine). Did you have any chance at all to look at the firmware of those?

(Also, in the xx30 series, does the X230 tablet have the same firmware as the X230? (I wouldn't expect them to be too different, at least...))

Ah, sorry - I misread your original message.

I have not bothered to buy any thinkpad newer than an xx30, so I have not looked closely. So, on top of the extensive plastics surgery that would be required due to the completely different keyboard shape:

I have not seen the schematic diagrams for any of these laptops, so I dont know what EC controller they use, however if it is similar, there may be some hope. The keyboard connector cable is completely different, so an adapter would need to be made for the keyboard matrix. The trackpoint buttons dont work the same way with newer generations either, but that is probably just a matter of even more plastics surgery.
Finally, I would expect that the firmware encryption method would have at least had its keys changed with a new generation.

So, not completely impossible, but mostly dependent on getting hardware and ripping it apart - as I mentioned above, I stopped purchasing thinkpad hardware in any volume after the x220 - when in my opinion, they started targeting a much more downmarket audience. If they want to play the "cheap" game, there is always a cheaper manufacturer to recommend - especially if they are going to have generic design, like their current keyboards. I am waiting for the Thinkpad Classic, but dont really expect it to actually be ever manufactured.

[brchan]

This is excellent work! When do you think you could make a bios or patch for W530 models, and do you know if all the pins for the keyboard connector are the same?

Also, would it be possible to do the flashing under Linux instead of Windows?

[hamish]

This is excellent work! When do you think you could make a bios or patch for W530 models, and do you know if all the pins for the keyboard connector are the same?

Also, would it be possible to do the flashing under Linux instead of Windows?

Can try and have a look at the W530 firmware in the next couple of days. As far as I know, all the xx30 models have the same keyboard pinout - but I have only personally confirmed that for the x230..

Doing the flashing under Linux would require reverse-engineering the dosflash.exe or winflash.exe programs, which seems like it is not worth the effort. I run Linux all the time, but just boot to a DOS disk to run the dosflash.exe - which is not too bad, since the system needs to reboot as soon as it has flashed the firmware anyway (I did it often enough that I created a small DOS partition on my hard disk

[hamish]

This is excellent work! When do you think you could make a bios or patch for W530 models, and do you know if all the pins for the keyboard connector are the same?

Also, would it be possible to do the flashing under Linux instead of Windows?

OK, so I had a chance to do this right away, I have updated the git repository with some patches for the w530. The full patch is at https://gist.github.com/hamishcoleman/4 ... d1ec17a59c

Let us know if you try it, so I can mark it as tested.

[wabamad]

Does the X230 tablet share the same ec as the x230?

[hamish]

Does the X230 tablet share the same ec as the x230?

The x230t uses a different embedded controller firmware, but it has the same keyboard tables in it, so these patches can be adapted for it as well.

[brchan]

Is there another way to install the patch instead of using dosflash? It doesn't seem available readily available and I can't find any documentation on what specific command to update the bios.

[Biased Opinion]

So which buttons are still non fuctional, the only ones i really care about is the home, end delete cluster.

[Tasurinchi]

Fantastic news!! Thanks to everybody that helped making this work

[hamish]

Is there another way to install the patch instead of using dosflash? It doesn't seem available readily available and I can't find any documentation on what specific command to update the bios.

The dosflash is included in every bios update ISO image - so I hadnt thought of that as an issue. However, now that I consider it, it is not exactly straight-forward to extract.

I'm going to work on making the patches apply to the whole ISO image, so the process should end up being "download the ISO, patch it, stick it on a CD, boot it"

[hamish]

So which buttons are still non fuctional, the only ones i really care about is the home, end delete cluster.

The only buttons that are not working are Fn+F12 (Hibernate), Fn+F3 (Battery) and Fn+Space (some magnify thing?) - so the important ones are all fine for you.

[RealBlackStuff]

@hamish:
YGPM

[Biased Opinion]

So which buttons are still non fuctional, the only ones i really care about is the home, end delete cluster.

The only buttons that are not working are Fn+F12 (Hibernate), Fn+F3 (Battery) and Fn+Space (some magnify thing?) - so the important ones are all fine for you.

Fantastic, ill be getting a classic keyboard soon to put in my x230 so the bios mod will be happening

[Radioguy]

Someone needs to breakout the trophy and start etching hamish on it under Middleton.

Maybe there's room on the bottom somewhere for me...someday.

[hamish]

Someone needs to breakout the trophy and start etching hamish on it under Middleton.

Maybe there's room on the bottom somewhere for me...someday.

Thanks, but I cannot take all the credit - it would not have happened without zmatt's decryption code and nitrocaster found half the tables we are patching.

[Biased Opinion]

So with this massive hurdle overcome what is the next logical progression in xx30 bios modding. I would say the best thing to tackle next would be the wifi card whitelist. from my understanding it was a check in the EC firmware which stopped the bios whitelists from being able to pass. So with us now being able to mod the EC firmware would it be possible to edit or remove this check and allow newer wifi cards such as the intel 7260. If that could be rolled into the current bios/EC mod it would make xx30 laptops even more attractive to others. I lack the technical knowledge to make changes to the code but im more than happy to test wifi cards and EC mods on my x230.

[hamish]

I have created a new patch that applies to the Lenovo ISO file, turning it into a bootable automated tool.

So far only the x230 patch has been created, and I will not have time to test that tonight.

I have updated the instructions and links with this new patch on the thinkwiki: http://www.thinkwiki.org/wiki/Install_C ... r_Firmware

[4bpp]

Thanks for your continued great work. The opening post referenced a schematic to identify the pins to be isolated in the keyboard connector. I unfortunately haven't been particularly lucky about finding the relevant schematic; could you perhaps point me at it?

[nitrocaster]

Thanks for your continued great work. The opening post referenced a schematic to identify the pins to be isolated in the keyboard connector. I unfortunately haven't been particularly lucky about finding the relevant schematic; could you perhaps point me at it?

I updated the top post with the link.

[hamish]

Thanks for your continued great work. The opening post referenced a schematic to identify the pins to be isolated in the keyboard connector. I unfortunately haven't been particularly lucky about finding the relevant schematic; could you perhaps point me at it?

I updated the top post with the link.

I dont think you need to isolate any pins, I have just re-examined the schematics and can see that the Fuse F5 is protecting against that short circuit. This fuse will blow the first time the laptop is turned on with the new keyboard and the short will stop.

This is still of concern to anyone who wanted to swap their backlit xx30 keyboard back into the laptop, as that is what is powered via that fuse.

While I was looking at the schematics, I noted that there were a very large number of optional parts in that area, most of them are not populated with any given option. It looks like they have populated "case2" in every engineering stage since Design Validation. To make it easier to see, I re-drew that part of the schematic (schematic) and then went and disassembled my x230 to confirm which parts were populated (close up of keyboard area)

[4bpp]

Thanks for your continued great work. The opening post referenced a schematic to identify the pins to be isolated in the keyboard connector. I unfortunately haven't been particularly lucky about finding the relevant schematic; could you perhaps point me at it?

I updated the top post with the link.

Thanks. Am I correct in the understanding that I'm already in the clear if I only isolate pin 27 one way or another? (In case of doubts or second thoughts, it seems easier to reconnect one signal wire than three...)

[nitrocaster]

I updated the top post with the link.

Thanks. Am I correct in the understanding that I'm already in the clear if I only isolate pin 27 one way or another? (In case of doubts or second thoughts, it seems easier to reconnect one signal wire than three...)

There's nothing to do with pin 27. You need to disconnect pins 25 and 29 from the keyboard - that can be done with duct tape (as I did) or by removing pins from the keyboard connector.

[StefanKo]

First of all, I am very much impressed by the deep level reverse engineering that was necessary to decipher the firmware and to find all keymaps.

Is the removal of the lenovo battery authenticity check included in the patch for the EC firmware that is in the wiki? If not, could it be included?

[nitrocaster]

I dont think you need to isolate any pins, I have just re-examined the schematics and can see that the Fuse F5 is protecting against that short circuit. This fuse will blow the first time the laptop is turned on with the new keyboard and the short will stop.

Fuse F5 does not protect against 4 amps being sent through the keyboard connector. And so it wont blow, fortunately for backlit keyboards.

While I was looking at the schematics, I noted that there were a very large number of optional parts in that area, most of them are not populated with any given option. It looks like they have populated "case2" in every engineering stage since Design Validation. To make it easier to see, I re-drew that part of the schematic (schematic) and then went and disassembled my x230 to confirm which parts were populated (close up of keyboard area)

Parts marked with DY are intended for engeneering version and are not installed in production version.

[emeraldgirl08]

Is the removal of the lenovo battery authenticity check included in the patch for the EC firmware that is in the wiki? If not, could it be included? Pretty please!

FTFY

I hope so too! If an easy to use software tool that eliminates or bypasses the authenticity check is developed and released I plan on replacing my X220 with an X230.

[4bpp]

Thanks. Am I correct in the understanding that I'm already in the clear if I only isolate pin 27 one way or another? (In case of doubts or second thoughts, it seems easier to reconnect one signal wire than three...)

There's nothing to do with pin 27. You need to disconnect pins 25 and 29 from the keyboard - that can be done with duct tape (as I did) or by removing pins from the keyboard connector.

Oh, so they're connected to some other grounded pin on the keyboard side? (I thought the problem was just that the keyboard connects 25, 27 and 29 to each other, thereby shorting 25/29 to the GND at 27, for some reason...)

Anyway, I'll try what you said. I'm still waiting for the X220 keyboard I ordered to arrive (so I can't quite see for myself yet), but do you think the location to apply duct tape to is fairly obvious once you take it apart? (Some contact just being held together with pressure...?)

[brchan]

When creating the W530 bios iso, I get the following make error:

Code: Select all

./slice.insert w530.G4HT39WW.img.enc.slice w530.G4HT39WW.img.enc w530.G4HT39WW.s01D5200.FL2
+ cp --reflink=auto w530.G4HT39WW.s01D5200.FL2.orig w530.G4HT39WW.s01D5200.FL2
+ dd status=none if=w530.G4HT39WW.img.enc bs=196608 count=1
+ dd status=none conv=notrunc bs=5242880 seek=1 of=w530.G4HT39WW.s01D5200.FL2
sed -e "s%__FL2%`mdir -/ -b -i g5uj28us.iso.orig@@71680 |grep FL2 |cut -d/ -f3-`%; s%__DESC%`cat g5uj28us.iso.orig.desc`%" autoexec.bat.template >g5uj28us.iso.bat
Total number of sectors (64195) not a multiple of sectors per track (32)!
Add mtools_skip_check=1 to your .mtoolsrc file to skip this test
./slice.insert w530.G4HT39WW.s01D5200.FL2.slice w530.G4HT39WW.s01D5200.FL2 g5uj28us.iso
+ cp --reflink=auto g5uj28us.iso.orig g5uj28us.iso
+ dd status=none if=w530.G4HT39WW.s01D5200.FL2 bs=12718080 count=1
+ dd status=none conv=notrunc bs=3628544 seek=1 of=g5uj28us.iso
mcopy -o -i g5uj28us.iso@@71680 g5uj28us.iso.bat ::AUTOEXEC.BAT
Total number of sectors (64195) not a multiple of sectors per track (32)!
Add mtools_skip_check=1 to your .mtoolsrc file to skip this test
Makefile:158: recipe for target 'g5uj28us.iso' failed
make: *** [g5uj28us.iso] Error 1

Any ideas for why?

[nitrocaster]

Anyway, I'll try what you said. I'm still waiting for the X220 keyboard I ordered to arrive (so I can't quite see for myself yet), but do you think the location to apply duct tape to is fairly obvious once you take it apart? (Some contact just being held together with pressure...?)

I made a 2-picture manual - see here.

[hamish]

When creating the W530 bios iso, I get the following make error:

Code: Select all

.
mcopy -o -i g5uj28us.iso@@71680 g5uj28us.iso.bat ::AUTOEXEC.BAT
Total number of sectors (64195) not a multiple of sectors per track (32)!
Add mtools_skip_check=1 to your .mtoolsrc file to skip this test
Makefile:158: recipe for target 'g5uj28us.iso' failed
make: *** [g5uj28us.iso] Error 1

Any ideas for why?

It looks like mtools must have changed between versions. Which version are you using? I've got 4.0.18 installed.

Can you try running "MTOOLS_SKIP_CHECK=1 mcopy -o -i g5uj28us.iso@@71680 g5uj28us.iso.bat ::AUTOEXEC.BAT"

This is the very last command before the ISO image is complete, so if that command works, you could then test it.

(A simple boot test can be done using a virtual machine: "qemu-system-i386 -enable-kvm -cdrom g5uj28us.iso")

If it works with that setting, I can update the makefile to add it permanently