| 11 | | Though you may disagree about whose fault this is, fact is that seemingly |
|---|
| 12 | | the Thinkpad can become corrupted even when only reading information from |
|---|
| 13 | | the i2c/SMBus. Be assured that we never, ever write any information to |
|---|
| 14 | | the bus while scanning(*), and that no halfway sane client implementation |
|---|
| 15 | | should change its internal state, not to mention overwrite system-critical |
|---|
| 16 | | information. |
|---|
| | 7 | In our releases through 2.6.4, sensors-detect (our userspace detection script) |
|---|
| | 8 | corrupts the Atmel 24RF08 eeprom. We have verified this in testing. |
|---|
| | 9 | After the eeprom is corrupted, the checksum verification in the BIOS |
|---|
| | 10 | will fail and the Thinkpad will not boot. |
|---|
| | 11 | |
|---|
| | 12 | The 24RF08 is an 8K eeprom appearing at addresses 0x54 - 0x57 with |
|---|
| | 13 | an additional "access protection page" at address 0x5c. |
|---|
| | 14 | This is an unusual eeprom that contains a RFID (Radio Frequency ID) |
|---|
| | 15 | port for wireless access, and elaborate access protection mechanisms. |
|---|
| | 16 | The 24RF08 gets confused (presumably due to a state machine flaw) by |
|---|
| | 17 | 'quick write 0' (*) probes our package uses for detection. |
|---|
| | 18 | This is in violation of the I2C specification. This corruption |
|---|
| | 19 | mechanism has never been reported to us on any other eeprom, |
|---|
| | 20 | Atmel or otherwise. |
|---|
| | 21 | |
|---|
| | 22 | We have made several changes in release 2.6.5 to minimize the |
|---|
| | 23 | chance of corruption: |
|---|
| | 24 | |
|---|
| | 25 | 1) Sensors-detect now accesses DMI information in the BIOS to identify |
|---|
| | 26 | the system manufacturer. If the system manufacturer is IBM, |
|---|
| | 27 | sensors-detect will print a message and exit. |
|---|
| | 28 | |
|---|
| | 29 | 2) The sequence of probes in sensors-detect has been changed so that |
|---|
| | 30 | 24RF08 eeproms are not corrupted. This *should* prevent corruption |
|---|
| | 31 | of 24RF08 eeproms in any non-IBM systems in most cases. |
|---|
| | 32 | |
|---|
| | 33 | 3) The i2c-piix4 module (the bus driver that is used for Intel PIIX4-based |
|---|
| | 34 | systems, including IBM Thinkpads) now accesses DMI information |
|---|
| | 35 | in the BIOS to identify the system manufacturer. If the system |
|---|
| | 36 | manufacturer is IBM, i2c-piix4 will print a message and exit. |
|---|
| | 37 | As the 24RF08 is on the PIIX4 SMBus, this prevents access to |
|---|
| | 38 | the 24RF08, even if sensors-detect is bypassed or sensors-detect |
|---|
| | 39 | does not recognize the system as IBM. |
|---|
| | 40 | |
|---|
| | 41 | 4) The sequence of probes in the eeprom module (when loaded with |
|---|
| | 42 | checksum=1) has been changed so that 24RF08 eeproms will |
|---|
| | 43 | not be corrupted. This *should* prevent corruption of 24RF08 |
|---|
| | 44 | eeproms in non-IBM systems. |
|---|
| | 45 | We do not have any reports of this corruption mechanism in releases |
|---|
| | 46 | 2.6.4 or earlier but have verified that it can happen. |
|---|
| | 47 | There is no issue unless the eeprom |
|---|
| | 48 | module is loaded with checksum=1, which is not the default. |
|---|
| | 49 | |
|---|
| | 50 | Even with these changes, we still DO NOT RECOMMEND INSTALLING |
|---|
| | 51 | lm_sensors 2.6.5 on IBM Thinkpads, because: |
|---|
| | 52 | |
|---|
| | 53 | 1) While these changes will dramatically reduce the chance of 24RF08 |
|---|
| | 54 | corruption, these changes have not been heavily tested. |
|---|
| | 55 | |
|---|
| | 56 | 2) lm_sensors won't run on IBM systems because of these changes. |
|---|
| | 57 | |
|---|
| | 58 | 3) IBM Thinkpads contain a proprietary Embedded Controller which |
|---|
| | 59 | is used to access sensors. This controller is not on the SMBus, |
|---|
| | 60 | and IBM will not release the programming interface to the |
|---|
| | 61 | controller. So lm_sensors isn't useful on Thinkpads anyway. |
|---|
| | 62 | |
|---|
| | 63 | |
|---|
| | 64 | As described above, our 2.6.5 release "blacklists" all IBM systems. |
|---|
| | 65 | Our next step is to refine the system detection so that only |
|---|
| | 66 | those models containing 24RF08's are blacklisted. We are working |
|---|
| | 67 | with IBM on a method of querying the MTM (Machine Type and Model) |
|---|
| | 68 | and comparing the MTM with a list of 24RF08-containing systems. |
|---|
| | 69 | After this change (which will be documented in our CHANGES file |
|---|
| | 70 | and this document), users of IBM systems without the |
|---|
| | 71 | 24RF08 and the proprietary Embedded Controller should be |
|---|
| | 72 | able to safely use lm_sensors. |
|---|
| | 73 | |
|---|
| | 74 | We do not have any reports of 24RF08 eeproms on non-IBM systems. |
|---|
| | 75 | If there are any such systems with 24RF08 eeproms, these changes will |
|---|
| | 76 | reduce the chances of corruption. However, there are |
|---|
| | 77 | theoretical scenarios (involving multiple bus masters, |
|---|
| | 78 | SMP systems, or simultaneous bus access) in which 24RF08's could |
|---|
| | 79 | still be corrupted. If you know of any non-IBM systems which contain |
|---|
| | 80 | these eeproms, please contact us. |
|---|
| | 81 | |
|---|
| | 82 | |
|---|
| | 83 | Thanks to IBM, the Linux Thinkpad Mailing List, and Joe in Australia |
|---|
| | 84 | for their assistance on this issue. |
|---|
