Support swap Fn and CtlL keys (how it should be) for the x200, middleton

For older Thinkpad models like the xx00 series the EC can not be configured
to swap Fn and Ctrl. This setting would usually be exposed in the BIOS setup
or in nvram when using coreboot.
Enabled by default for models where this can not be configured.

Updates: hamishcoleman#4

.gitignore

@@ -11,6 +11,7 @@
 
 # ignore generated files
 *.bat
+*.diff
 .d
 
 # Temp are (should be) just junk

Descriptions.txt

@@ -13,6 +13,8 @@
 # english description.
 
 # The iso images downloadable from Lenovo
+6duj41uc.iso.orig  016b85296694340cc1b70c956e6fdd775b14d261 x200 and x200s BIOS 3.14 (6DET64WW) EC 1.06 (7XHT24WW)
+6duj48us.iso.orig  461fe63039eb3849ff025d4bcb89b86a3607bf95 x200 and x200s BIOS 3.22 (6DET72WW) EC 1.07 (7XHT25WW)
 8duj27us.iso.orig  856a1a3efee305d335df10932b54aa478f818677 x220 BIOS 1.42 (8DET72WW) EC 1.24 (8DHT34WW)
 g1uj25us.iso.orig  759e27829c13d591b097cbda2f34843265ef8813 t430 BIOS 2.57 (G1ET97WW) EC 1.12 (G1HT34WW)
 g1uj38us.iso.orig  50a2c12ca5ed37ec80c0dbcb4d53f2b49b165d17 t430 BIOS 2.70 (G1ETB0WW) EC 1.13 (G1HT35WW)

Makefile

@@ -27,15 +27,16 @@ list_laptops:
 	$(info patched.x230.img  - for patching Thinkpad X230)
 	$(info patched.x230t.img - for patching Thinkpad X230t)
 	$(info )
-	$(info patched.t430.257.img  - for patching Thinkpad T430 BIOS 2.57 - no keyboard patch)
+	$(info patched.t430.257.112.img - for patching Thinkpad T430 BIOS 2.57/EC 1.12 - no keyboard patch)
+	$(info patched.x200.314.106.img - for patching Thinkpad x200 and x200s BIOS 3.14/EC 1.06 - only Fn Ctrl swap)
 	$(info )
 
 .PHONY: list_laptops
 
 # Remove all the usual junk (including any patched firmware images)
 clean:
-	rm -f patched.*.iso patched.*.img *.FL2 *.FL2.orig *.img.enc \
-            *.img.enc.orig *.img.orig *.bat \
+	rm -f patched.*.iso patched.*.img *.FL2 *.FL2.orig *.img.enc *.img.csum_ok \
+            *.img.enc.orig *.img.csum_ok.orig *.img.orig *.bat \
             *.img
 
 # Also remove the large downloaded iso images
@@ -47,7 +48,7 @@ really_clean: clean
 patched.t430.iso: g1uj40us.iso
 	$(call patched_iso,$<,$@)
 
-patched.t430.257.iso: g1uj25us.iso
+patched.t430.257.112.iso: g1uj25us.iso
 	$(call patched_iso,$<,$@)
 
 patched.t430s.iso: g7uj19us.iso
@@ -62,6 +63,12 @@ patched.t530i.iso: g4uj30us.iso
 patched.w530.iso: g5uj28us.iso
 	$(call patched_iso,$<,$@)
 
+patched.x200.314.106.iso: 6duj41uc.iso
+	$(call patched_iso,$<,$@)
+
+patched.x200.314.106.img:
+	$(info The image intended for USB sticks seems not to boot for this model.)
+
 patched.x230.iso: g2uj25us.iso
 	$(call patched_iso,$<,$@)
 
@@ -95,7 +102,7 @@ list_images:
 # All the bios update iso images I have checked have had a fat16 filesystem
 # embedded in a dos mbr image as the el-torito ISO payload.  They also all
 # had the same offset to this fat filesystem, so hardcode that offset here.
-FAT_OFFSET := 71680
+export FAT_OFFSET := 71680
 
 # Some versions of mtools need this flag set to allow them to work with the
 # dosfs images used by Lenovo - from my tests, it may be that Debian has
@@ -107,6 +114,8 @@ export MTOOLS_SKIP_CHECK=1
 # so this target hacks around that
 #
 install.radare.projects:
+	mkdir -p ~/.config/radare2/projects/x200.7XHT24WW
+	cp -fs $(PWD)/radare/x200.7XHT24WW ~/.config/radare2/projects/x200.7XHT24WW/rc
 	mkdir -p ~/.config/radare2/projects/x220.8DHT34WW.d
 	cp -fs $(PWD)/radare/x220.8DHT34WW ~/.config/radare2/projects
 	mkdir -p ~/.config/radare2/projects/x230.G2HT35WW
@@ -137,6 +146,12 @@ patch_disable_keyboard:
 	 $(call patch_disable,$$j); \
 	done
 
+patch_enable_fn_ctrl_swap:
+	$(call patch_enable,008_fn_ctrl_swap.patch)
+
+patch_disable_fn_ctrl_swap:
+	$(call patch_disable,008_fn_ctrl_swap.patch)
+
 # $1 is the old patch name
 # $2 is the new patch name
 define patch_mv
@@ -199,6 +214,12 @@ $(DEPSDIR)/slice.insert.deps: Makefile
 %.img.enc:  %.img scripts/xx30.encrypt
 	./scripts/xx30.encrypt $< $@
 
+# A generic outer checksum fixer
+%.img.csum_ok: %.img mec-tools/mec_csum_outer
+	cp --reflink=auto $< $@
+	./mec-tools/mec_csum_outer -f $@
+	./mec-tools/mec_csum_outer -c $@
+
 # TODO
 # - if we ever get generic extraction or encryption for more than
 #   just the Xx30 series, these generic rules will need to be reworked
@@ -218,7 +239,12 @@ $(DEPSDIR)/slice.insert.deps: Makefile
 # my mind to it..
 #
 %.iso.bat: %.iso.orig autoexec.bat.template
-	sed -e "s%__DIR%`mdir -/ -b -i $<@@$(FAT_OFFSET) |grep FL2 |cut -d/ -f3`%; s%__FL2%`mdir -/ -b -i $<@@$(FAT_OFFSET) |grep FL2 |cut -d/ -f4`%; s%__DESC%`scripts/describe $<`%; s/__BUILDINFO/$(BUILDINFO)/" autoexec.bat.template >$@.tmp
+	if echo '$@' | grep '^6duj4' -q; then \
+	 cp --reflink=auto autoexec.bat.command_com.template $@.tmp; \
+	else \
+	 cp --reflink=auto autoexec.bat.template $@.tmp; \
+	fi
+	sed -e "s%__DIR%`mdir -/ -b -i $<@@$(FAT_OFFSET) |grep FL2 |cut -d/ -f3 | head -n 1`%; s%__FL2%`mdir -/ -b -i $<@@$(FAT_OFFSET) |grep FL2 |cut -d/ -f4 | head -n 1`%; s%__DESC%`scripts/describe $<`%; s/__BUILDINFO/$(BUILDINFO)/" --in-place $@.tmp
 	mv $@.tmp $@
 	touch -d @1 $@
 
@@ -287,34 +313,38 @@ mec-tools/mec_encrypt: mec-tools/Makefile
 	git submodule update
 	make -C mec-tools
 
+mec-tools/mec_csum_outer: mec-tools/Makefile
+	git submodule update
+	make -C mec-tools
+
 # using function calls to build rules with actions is kind of a hack,
 # which is why these are all on oneline.
 
 # Insert the new firmware into the FL2 file
-# $1 = encoded EC firmware
+# $1 = repacked (csums fixed and optionally re-encrypted) EC firmware
 # $2 = FL2 filename
 define rule_fl2_patch
-    $(2): $(1) ; ./scripts/slice.insert $(1).slice $(1) $(2)
+    $(2): $(1) ./scripts/slice.insert ; ./scripts/slice.insert $(1).slice $(1) $(2)
 endef
 
 # Create a new ISO image with patches applied
 # $1 = FL2 filename
 # $2 = ISO image
 define rule_iso
-    $(2): $(1) $(2).bat ; cp --reflink=auto $(2).orig $(2) && ./scripts/copyFL2 to_iso $(2) $(1) && sed -i "s/__BUILT/`sha1sum $(1)`/" $(2).bat && mcopy -m -o -i $(2)@@$(FAT_OFFSET) $(2).bat ::AUTOEXEC.BAT && mdel -i $(2)@@$(FAT_OFFSET) ::EFI/Boot/BootX64.efi
+    $(2): $(1) $(2).bat ./scripts/copyFL2 ; cp --reflink=auto $(2).orig $(2) && ./scripts/copyFL2 to_iso $(2) $(1) && sed -i "s/__BUILT/`sha1sum $(1)`/" $(2).bat && mcopy -m -o -i $(2)@@$(FAT_OFFSET) $(2).bat ::AUTOEXEC.BAT && if mdir -/ -b -i $(2)@@71680 |grep EFI -q; then mdel -i $(2)@@$(FAT_OFFSET) ::EFI/Boot/BootX64.efi; fi
 endef
 
 # Extract the FL2 file from an ISO image
 # Note that the parameters here are essentially the same as rule_iso, but you cannot
 # define two targets with one define..
-# $1 = FL2 filename basename
+# $1 = FL2 file basename
 # $2 = ISO image basename
 #
 # TODO - checking the checksum here is probably too strict - it adds
 # more barriers to downloading some random bios ISO and starting to port
 # the code to it.
 define rule_fl2_extract
-    $(1).orig: $(2).orig ; ./scripts/copyFL2 from_iso $(2).orig $(1).orig && ./scripts/checksum --rm_on_fail $(2).orig
+    $(1).orig: $(2).orig ./scripts/copyFL2 ; ./scripts/copyFL2 from_iso $(2).orig $(1).orig && ./scripts/checksum --rm_on_fail $(2).orig
 endef
 
 #
@@ -329,11 +359,15 @@ $(call rule_fl2_patch,t430.G1HT35WW.img.enc,t430.G1HT35WW.s01D2000.FL2)
 $(call rule_fl2_patch,t430s.G7HT39WW.img.enc,t430s.G7HT39WW.s01D8000.FL2)
 $(call rule_fl2_patch,t530.G4HT39WW.img.enc,t530.G4HT39WW.s01D5100.FL2)
 $(call rule_fl2_patch,w530.G4HT39WW.img.enc,w530.G4HT39WW.s01D5200.FL2)
+$(call rule_fl2_patch,x200.7XHT24WW.img.csum_ok,x200.7XHT24WW.s01B9x00.FL2)
+$(call rule_fl2_patch,x200.7XHT25WW.img.csum_ok,x200.7XHT25WW.s01B9x00.FL2)
 $(call rule_fl2_patch,x230.G2HT35WW.img.enc,x230.G2HT35WW.s01D3000.FL2)
 $(call rule_fl2_patch,x230t.GCHT25WW.img.enc,x230t.GCHT25WW.s01DA000.FL2)
 
 $(call rule_iso,t430.G1HT34WW.s01D2000.FL2,g1uj25us.iso)
 $(call rule_iso,t430.G1HT35WW.s01D2000.FL2,g1uj40us.iso)
+$(call rule_iso,x200.7XHT24WW.s01B9x00.FL2,6duj41uc.iso)
+$(call rule_iso,x200.7XHT25WW.s01B9x00.FL2,6duj48us.iso)
 $(call rule_iso,x230.G2HT35WW.s01D3000.FL2,g2uj25us.iso)
 $(call rule_iso,t530.G4HT39WW.s01D5100.FL2,g4uj30us.iso)
 $(call rule_iso,w530.G4HT39WW.s01D5200.FL2,g5uj28us.iso)
@@ -342,6 +376,8 @@ $(call rule_iso,x230t.GCHT25WW.s01DA000.FL2,gcuj24us.iso)
 
 $(call rule_fl2_extract,t430.G1HT35WW.s01D2000.FL2,g1uj40us.iso)
 $(call rule_fl2_extract,t430.G1HT34WW.s01D2000.FL2,g1uj25us.iso)
+$(call rule_fl2_extract,x200.7XHT24WW.s01B9x00.FL2,6duj41uc.iso)
+$(call rule_fl2_extract,x200.7XHT25WW.s01B9x00.FL2,6duj48us.iso)
 $(call rule_fl2_extract,x230.G2HT35WW.s01D3000.FL2,g2uj25us.iso)
 $(call rule_fl2_extract,t530.G4HT39WW.s01D5100.FL2,g4uj30us.iso)
 $(call rule_fl2_extract,w530.G4HT39WW.s01D5200.FL2,g5uj28us.iso)

README

@@ -1,6 +1,10 @@
 The main purpose of this software is to patch the EC on xx30 series thinkpads
-to make the classic 7-row keyboards work.  There are also patches included (but
-disabled by default) to disable the authentic battery validation check.
+to make the classic 7-row keyboards work.  Furthermore, the following patches
+are available for some thinkpad models:
+
+* Turning off the authentic battery validation check.
+  The battery patches are disabled by default, but are easy to enable.
+* Swap Fn and CtlL keys so that the physical layout becomes CtlL, Fn (how it should be).
 
 With the patches included here, you can install the classic keyboard
 hardware on many xx30 series laptops and make almost every key work properly.

autoexec.bat.template

@@ -4,7 +4,8 @@ cd c:\flash
 cls
 echo.
 echo.
-echo This will flash your firmware to support a classic 7-row keyboard
+echo This will flash your EC firmware to support a classic 7-row keyboard (default)
+echo or other modifications as configured at modification time.
 echo.
 echo.
 echo WARNING: Incorrectly flashing your firmware can damage your laptop.

docs/CONFIG.txt

@@ -1,9 +1,16 @@
 Configuring which patches are used
 ----------------------------------
 
-This repository has two sets of patches - one set for the keyboard
-changes and one for turning off the battery validation.  The battery
-patches are disabled by default, but are easy to enable.
+This repository has contains the following sets of patches for various ThinkPad models:
+
+* Patch to use the classical IBM keyboard instead of the newer Lenovo chiclet keyboard.
+* Turning off the authentic battery validation check.
+  The battery patches are disabled by default, but are easy to enable.
+* Swap Fn and CtlL keys so that the physical layout becomes CtlL, Fn (how it should be).
+  For older Thinkpad models like the xx00 series the EC can not be configured
+  to swap Fn and Ctrl. This setting would usually be exposed in the BIOS setup
+  or in nvram when using coreboot.
+  Enabled by default for models where this can not be configured.
 
 Any combination of the two sets of patches can be enabled or disabled
 (even including a version with no patches at all - to revert all changes)
@@ -12,10 +19,12 @@ There are several makefile targets that exist to help you configure which
 patches are enabled.  Choose one or more of the following commands to
 configure as you want:
 
-    make patch_enable_battery clean     # Uses the battery validate patch
-    make patch_disable_battery clean    # Turns off the battery validate patch
-    make patch_enable_keyboard clean    # Uses the keyboard patches
-    make patch_disable_keyboard clean   # Turns off the keyboard patches
+    make patch_enable_battery clean       # Uses the battery validate patch
+    make patch_disable_battery clean      # Turns off the battery validate patch
+    make patch_enable_keyboard clean      # Uses the keyboard patches
+    make patch_disable_keyboard clean     # Turns off the keyboard patches
+    make patch_enable_fn_ctrl_swap clean  # Uses the Fn and CtlL key swap patches
+    make patch_disable_fn_ctrl_swap clean # Turns off the Fn and CtlL key swap patches
 
 Behind the scenes
 -----------------

docs/HACKING.txt

@@ -15,7 +15,7 @@ To use the radare projects, first install the project files:
 
 Then ensure you have the image file(s):
 
-    make x220.8DHT34WW.img x230.G2HT35WW.img x260.R02HT29W.img 
+    make x200.7XHT24WW.img x220.8DHT34WW.img x230.G2HT35WW.img x260.R02HT29W.img
 
 Then start radare with one of these projects:
 
@@ -49,7 +49,7 @@ probably useful:
     the dosflash.exe utility to a DOS boot disk and then use a command
     similar to:
 
-        
+
         dosflash /sd /ipf ec /file s01D3000.FL2
 
     To insert the firmware image back into the bootable cdrom and boot this

docs/firmware_layout.txt

@@ -52,7 +52,7 @@ These addresses have been seen to be stable in all the checked firmwares.
 
 Notes:
 
-* The x220 firmware starts the copyright string at 0x00264, which
+* The x200 and x220 firmware starts the copyright string at 0x00264, which
   might just be because the default variable size on the H8S is 16bits,
   instead of the 32bit default on the ARC cpu - and that there are two
   default-sized variables before this string.