| 1 |
|
|---|
| 2 |
**** WARNING: IBM Thinkpad users should not install lm_sensors! **** |
|---|
| 3 |
|
|---|
| 4 |
The eeprom of some IBM Thinkpads have been corrupted after installing |
|---|
| 5 |
lm_sensors. |
|---|
| 6 |
|
|---|
| 7 |
In our releases through 2.6.4, sensors-detect (our userspace detection script) |
|---|
| 8 |
corrupts the Atmel 24RF08 eeprom. We have verified this in testing. |
|---|
| 9 |
After the eeprom is corrupted, the checksum verification in the BIOS |
|---|
| 10 |
will fail and the Thinkpad will not boot. |
|---|
| 11 |
|
|---|
| 12 |
The 24RF08 is an 8K eeprom appearing at addresses 0x54 - 0x57 with |
|---|
| 13 |
an additional "access protection page" at address 0x5c. |
|---|
| 14 |
This is an unusual eeprom that contains a RFID (Radio Frequency ID) |
|---|
| 15 |
port for wireless access, and elaborate access protection mechanisms. |
|---|
| 16 |
The 24RF08 gets confused (presumably due to a state machine flaw) by |
|---|
| 17 |
the 'quick write 0' (*) probes our package uses for detection. |
|---|
| 18 |
This behavior is in violation of the I2C specification. This corruption |
|---|
| 19 |
mechanism has never been reported to us on any other eeprom, |
|---|
| 20 |
Atmel or otherwise. |
|---|
| 21 |
|
|---|
| 22 |
We have made several changes in release 2.6.5 to minimize the |
|---|
| 23 |
chance of corruption: |
|---|
| 24 |
|
|---|
| 25 |
1) Sensors-detect now accesses ACPI and DMI information in the BIOS to |
|---|
| 26 |
identify the system manufacturer. If the system manufacturer is IBM, |
|---|
| 27 |
sensors-detect will print a message and exit. |
|---|
| 28 |
|
|---|
| 29 |
2) The sequence of probes in sensors-detect has been changed so that |
|---|
| 30 |
24RF08 eeproms are not corrupted. This *should* prevent corruption |
|---|
| 31 |
of 24RF08 eeproms in any non-IBM systems in most cases. |
|---|
| 32 |
|
|---|
| 33 |
3) The i2c-piix4 module (the bus driver that is used for Intel PIIX4-based |
|---|
| 34 |
systems, including IBM Thinkpads) now accesses DMI information |
|---|
| 35 |
in the BIOS to identify the system manufacturer. If the system |
|---|
| 36 |
manufacturer is IBM, i2c-piix4 will print a message and exit. |
|---|
| 37 |
As the 24RF08 is on the PIIX4 SMBus, this prevents access to |
|---|
| 38 |
the 24RF08, even if sensors-detect is bypassed or sensors-detect |
|---|
| 39 |
does not recognize the system as IBM. |
|---|
| 40 |
|
|---|
| 41 |
4) The sequence of probes in the eeprom module (when loaded with |
|---|
| 42 |
checksum=1) has been changed so that 24RF08 eeproms will |
|---|
| 43 |
not be corrupted. This *should* prevent corruption of 24RF08 |
|---|
| 44 |
eeproms in non-IBM systems. |
|---|
| 45 |
We do not have any reports of this corruption mechanism in releases |
|---|
| 46 |
2.6.4 or earlier but have verified that it can happen. |
|---|
| 47 |
There is no issue unless the eeprom |
|---|
| 48 |
module is loaded with checksum=1, which is not the default. |
|---|
| 49 |
|
|---|
| 50 |
Even with these changes, we still DO NOT RECOMMEND INSTALLING |
|---|
| 51 |
lm_sensors 2.6.5 or later on IBM Thinkpads, because: |
|---|
| 52 |
|
|---|
| 53 |
1) While these changes will dramatically reduce the chance of 24RF08 |
|---|
| 54 |
corruption, these changes have not been heavily tested. |
|---|
| 55 |
|
|---|
| 56 |
2) lm_sensors won't run on IBM systems because of these changes. |
|---|
| 57 |
|
|---|
| 58 |
3) IBM Thinkpads contain a proprietary Embedded Controller which |
|---|
| 59 |
is used to access sensors. This controller is not on the SMBus, |
|---|
| 60 |
and IBM will not release the programming interface to the |
|---|
| 61 |
controller. So lm_sensors isn't useful on Thinkpads anyway. |
|---|
| 62 |
|
|---|
| 63 |
You may want to try ACPI instead, it should let you get some information |
|---|
| 64 |
about temperatures and fan status. |
|---|
| 65 |
|
|---|
| 66 |
As described above, our 2.6.5 and later releases "blacklists" all IBM |
|---|
| 67 |
systems. Our next step is to refine the system detection so that only |
|---|
| 68 |
those models containing 24RF08's are blacklisted. We are working |
|---|
| 69 |
with IBM on a method of querying the MTM (Machine Type and Model) |
|---|
| 70 |
and comparing the MTM with a list of 24RF08-containing systems. |
|---|
| 71 |
After this change (which will be documented in our CHANGES file |
|---|
| 72 |
and this document), users of IBM systems without the |
|---|
| 73 |
24RF08 and the proprietary Embedded Controller should be |
|---|
| 74 |
able to safely use lm_sensors. |
|---|
| 75 |
|
|---|
| 76 |
We would very much like to support IBM systems which contain |
|---|
| 77 |
non-proprietary sensor devices. Unfortunately, until we have |
|---|
| 78 |
a reliable identification method implemented, we must |
|---|
| 79 |
blacklist all IBM systems to minimize the chance of eeprom corruption. |
|---|
| 80 |
|
|---|
| 81 |
We do not have any reports of 24RF08 eeproms on non-IBM systems. |
|---|
| 82 |
If there are any such systems with 24RF08 eeproms, these changes will |
|---|
| 83 |
reduce the chances of corruption. However, there are |
|---|
| 84 |
theoretical scenarios (involving multiple bus masters, |
|---|
| 85 |
SMP systems, or simultaneous bus access) in which 24RF08's could |
|---|
| 86 |
still be corrupted. If you know of any non-IBM systems which contain |
|---|
| 87 |
these eeproms, please contact us. |
|---|
| 88 |
|
|---|
| 89 |
|
|---|
| 90 |
Thanks to IBM, the Linux Thinkpad Mailing List, and Joe in Australia |
|---|
| 91 |
for their assistance on this issue. |
|---|
| 92 |
|
|---|
| 93 |
For more information, see: |
|---|
| 94 |
|
|---|
| 95 |
The Linux Thinkpad Mailing List |
|---|
| 96 |
http://www.bm-soft.com/~bm/tp_mailing.html |
|---|
| 97 |
|
|---|
| 98 |
Joe in Australia's Thinkpad Password Recovery Site |
|---|
| 99 |
http://www.ja.olm.net/unlock |
|---|
| 100 |
|
|---|
| 101 |
Atmel 24RF08 Datasheet |
|---|
| 102 |
http://www.atmel.com/atmel/products/prod227.htm |
|---|
| 103 |
|
|---|
| 104 |
|
|---|
| 105 |
(*) 'Write Quick 0' is not an actual write and should never generate |
|---|
| 106 |
a write operation to an eeprom location. |
|---|