ThinkWiki - User contributions [en]

How to enable integrated fingerprint reader with BioAPI

2007-02-18T08:31:02Z

Jamesavery: /* Testing the driver and enrolling a fingerprint */ stdlib.h missing from NonGUI_Example

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;white-space:nowrap;" | __TOC__
|style="vertical-align:top" |
This page describes the process of getting the [[Integrated Fingerprint Reader|integrated fingerprint reader]] to work under Linux, using bioapi and binary-only drivers. It is based on experiences in {{Ubuntu}} on a T43. The same works on {{Fedora}} 4 and 5, RHEL4, SuSE 9.3, SuSE 10, and {{Gentoo}}. Note that experimental open-source driver is available, see [[Integrated Fingerprint Reader|fingerprint reader]] page for details.
|}

==Basic installation==
===Installing the bioapi framework===
====Automated installation script====
The [[Script for enabling the fingerprint reader]] automates the installation of most components (bioapi framework, driver, pam_bioapi, pam setup, device permissions, pamtester and enrolling), for some Linux distributions.

====Binary packages====

Note that these packages only take care of this one section. If you can use one, you should do so and then proceed to the section entitled, Installing and Configuring the Driver.

=====Debian/ Ubuntu Dapper=====
*If you're using {{Debian}} Sid (the unstable branch) or {{Ubuntu}} Dapper Drake 6.06 LTS you can try the packages from Michael R. Crusoe's site, either [http://www.qrivy.net/~michael/temp/ version 1.2.3] (recommended) or [http://www.qrivy.net/~michael/debs/unstable/ older versions] which might not work with the steps in this howto.

{{HINT|Ignore the warning about not finding ''/usr/lib/libqtpwbsp.so'', it's not fatal.}}

=====Gentoo=====
Gentoo now includes needed ebuilds. Just run

''ACCEPT_KEYWORDS=~x86 emerge pam_bioapi''

You can also grab the [http://www.qrivy.net/~michael/blua/bioapi/bioapi-1.2.2.ebuild.tar.bz2 ebuild], or use the source-install procedure below.

Also see [http://toe.ch/~tsa/ibm-fingerprint/ http://toe.ch/~tsa/ibm-fingerprint/] for alternative documentation on installing on Gentoo including ebuilds for all the packages used.

=====Fedora Core=====
RPM packages for Fedora Core and installation instructions are available [[Installing Fedora Core 5 on a ThinkPad X41 Tablet#Fingerprint_Reader|here]]

====Installing from source====
*Get the bioapi source:
:{{cmduser|wget http://www.qrivy.net/~michael/blua/bioapi/bioapi-latest.tar.bz2}}
*I could not compile bioapi with the graphical Qt tools. To do it manually, do the following:
:{{cmduser|tar xjf bioapi-latest.tar.bz2}}
:{{cmduser|cd bioapi-1.2.2}}
:{{cmduser|1=./configure --with-Qt-dir=no}}
:{{cmduser|make}}
:and then as root
:{{cmdroot|make install}}
:If make install fails, be sure you're root and then:
:{{cmdroot|1=export LD_LIBRARY_PATH=/usr/local/lib}}
:{{cmdroot|make install}}
:and if you want to compile pam_bioapi for auth later
:{{cmdroot|cp include/bioapi_util.h include/installdefs.h imports/cdsa/v2_0/inc/cssmtype.h /usr/include}}
:Be aware that checkinstall will not work!
:(I got through configure with Qt, but got a cryptic build error. It all worked fine with Qt disabled as above)
:buzz: This is due to a wrong qt include path, set it manually in configure and everything should work.
*Bioapi (at least version 1.2.2) doesn't compile with GCC4. You need to patch it:
*This is neccessary to compile on SUSE 10.1 which it using gcc version 4.1.0.
:{{cmduser|wget http://upir.cz/linux/patches/bioapi-1.2.2-gcc4.patch}}
:{{cmduser|patch -p1 < bioapi-1.2.2-gcc4.patch}}
*Patch for gcc 4.1 is available here - http://cvs.pld-linux.org/cgi-bin/cvsweb/SOURCES/bioapi-c++.patch?rev=1.3
* By default, bioapi will install numerous files in {{path|/usr/local/<nowiki>{</nowiki>bin,lib,include<nowiki>}</nowiki>}}, including files with "self-explanatory" names such as {{path|/usr/local/bin/Sample}}. To prevent this pollution:
:Create a dedicated directory, for example {{path|/opt/bioapi}} .
:Append <tt>--prefix=/opt/bioapi</tt> to the above <tt>./configure</tt> command.
:Append {{path|/opt/bioapi/bin}} to <tt>$PATH</tt> and {{path|/opt/bioapi/lib}} to <tt>$LD_LIBRARY_PATH</tt>.
:When installing the driver (below), tell it the new install path: {{cmdroot|sh install.sh /opt/bioapi/lib}}

====Adjusting ldconfigs library search path====
At least on {{Fedora}} or {{Aurox}} 11, you may need to add {{path|/usr/local/lib}} to the library path so that the libraries referenced from <tt>pam_bioapi.so</tt> get picked up properly. The usual way to do this is adding it to the ldconfig configuration:
:{{cmdroot|echo '/usr/local/lib' > /etc/ld.so.conf.d/bioapi.conf}}
:{{cmdroot|ldconfig}}
Alternatively you can add it to the LD_LIBRARY variable.

If you see bioapi libs in the output of
:{{cmdroot|ldconfig -p | grep bioapi}}
then it should work.

===Installing and configuring the driver===
====Installing the driver====
*Download {{path|TFMESS_BSP_LIN_1.0.zip}} from the [http://www.upek.com/support/dl_linux_bsp.asp UPEK support site] and unzip it into a seperate folder, as it will not create one.
*Change to that folder and do as root:
:{{cmdroot|sh install.sh}}
:If you're running Gentoo, Debian or Ubuntu Dapper, use
:{{cmdroot|sh install.sh /usr/lib}}
{{HINT|
For me it didn't work this way, but following did:
:sh install.sh /usr/local/lib
greetings, tec}}
{{HINT|On my debian install I had to "cp libtfmessbsp.so /usr/lib" to avoid a errormessage during "sh install.sh /usr/lib": "Could not find file:/usr/lib/libtfmessbsp.so"}}
:If that fails, it may be that make install failed up above -- try setting LD_LIBRARY_PATH, do the make install again, and come back here and try this again. You also need {{cmd|mod_install|}} from bioapi in your PATH.
:May there still occures and error, which means mod_install: command not found.
:Then login as root - not su!
:Do this:
:{{cmdroot|sh install.sh}}
:again. It should work. SU to root does not work since then the /usr/local/bin directory is not used per default.

====Configuring permissions for non-root use====
If you want to use PAM-aware applications like xscreensaver that are NOT running with root permissions (as opposed to login, gdm or other authentication mechanisms), you may need to do all or at least some of the things in this section. More details on what is necessary on which distributions would be greately appreciated.
*Create two groups, one for access to BioAPI files and the other for access to the usb files. (This is done for full generality; i.e., you may have other USB devices which you want accessable to other users, without exposing your BioAPI configuration to them). Add your normal user (the one you wish to use PAM-aware applications with) to both of these groups.
On {{Debian}} this is done with
:{{cmdroot|addgroup --system bioapi}}
:{{cmdroot|addgroup --system usbfs}}
:{{cmdroot|adduser yournormaluser bioapi}}
:{{cmdroot|adduser yournormaluser usbfs}}
On {{SUSE}} this is done with
:{{cmdroot|groupadd --system bioapi}}
:{{cmdroot|groupadd --system usbfs}}
:{{cmdroot|groupmod -A yournormaluser bioapi}}
:{{cmdroot|groupmod -A yournormaluser usbfs}}
On {{Mandriva}} this is done with
:{{cmdroot|groupadd -r bioapi}}
:{{cmdroot|groupadd -r usbfs}}
:{{cmdroot|usermod -G bioapi,usbfs yournormaluser}}
On {{Fedora}} this is done with
:{{cmdroot|groupadd bioapi}}
:{{cmdroot|groupadd usbfs}}
:{{cmdroot|usermod -G bioapi,usbfs yournormaluser}}

:(where {{cmd|yournormaluser|}} is your normal user name). You will need to log out and log back in for this to take effect.
*Set permissions on the BioAPI config/registry directory:
:{{cmdroot|chown -R root:bioapi /usr/local/var/bioapi/}}
:{{cmdroot|chmod -R 770 /usr/local/var/bioapi/}}
:(change this path if you used an alternate BioAPI install directory above)
*Set permissions on the files in {{path|/proc/bus/usb}}:
:{{cmdroot|chown -R root:usbfs /proc/bus/usb}}
:{{cmdroot|chmod -R g+X /proc/bus/usb}}
:{{cmdroot|chown root:usbfs /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:{{cmdroot|chmod 660 /proc/bus/usb/`lsusb <nowiki>|</nowiki> sed -ne "/0483:2016/s/Bus\ $.*$\ Device\ $.*$:\ .*/\1\/\2/p"`}}
:You may need to replace {{cmd|lsusb|}} with its full path, which is something like {{cmd|/sbin/lsusb|}} or {{cmd|/usr/bin/lsusb|}} depending on your distro. It might be necessary to put these lines into a script which is run at startup and resume from suspend/hibernate.
In {{Fedora}} {{cmd|lsusb|}} is not installed by default. To intall it just type:
:{{cmdroot|yum install usbutils}}

*As an alternative to the {{cmd|chown|}}/{{cmd|chmod|}} commands above, you can set mount options for usbfs with a line in {{path|/etc/fstab|}}; an example would be
none /proc/bus/usb usbfs defaults,devgid=108,devmode=0660,busgid=108,busmode=0770,listgid=108,listmode=0660 0 0
:where 108 is replaced with the numerical group ID of the usbfs group (you can determine this with something like {{cmd|cat /etc/group <nowiki>|</nowiki> grep usbfs <nowiki>|</nowiki> cut -d':' -f 3|}}). Make sure you only have one {{path|/proc/bus/usb}} entry in {{path|/etc/fstab}}. See the {{cmd|mount(8)|}} manpage for more information on these options. This is "cleaner" but seems to have a few weird issues -- see the talk page for details.
*You may also have files in {{path|/dev/bus/usb}}, which the driver will try before {{path|/proc/bus/usb}}. If this is another usbfs mount point ({{cmd|mount|}} shows a line containing {{cmdresult|/dev/bus/usb type usbfs}}), then simply follow the above instructions with {{path|/dev/bus/usb}} rather than {{path|/proc/bus/usb}}. Otherwise, you may be running a new kernel (i.e. 2.6.15) that makes usbfs-like files available through {{path|/dev/bus/usb}}.
*On systems running udev these files are dynamically created; you can configure their permissions by editing a udev config file. On Debian this is done by changing the <tt>usb_device</tt> line of {{path|/etc/udev/permissions.rules}} to read
SUBSYSTEM=="usb_device", MODE="0660", GROUP="usbfs"
*For the beta versions only, there is a logfile, which needs to exist with the proper permissions:
:{{cmdroot|touch /var/log/BSP.log && chown root:bioapi /var/log/BSP.log && chmod 660 /var/log/BSP.log}}

====Miscellaneous configuration====
* To increase the security level (minimize false accept rate), set this in {{path|/etc/tfmessbsp.cfg}}:
security-level="5"
{{WARN|Please see discussion section Security Level!}}

===Testing the driver and enrolling a fingerprint===
To test the driver and generate the file containing your fingerprint information, you need a sample program included with the driver. The compilation steps below were discovered by trial and error; if they don't work for you, try the binary {{cmd|Sample|}} utility that came with the beta versions of the driver (i.e., {{path|TFMESS_BSP_LIN_1.0beta2.zip}} as mentioned above).
Go to the folder where you extracted {{path|TFMESS_BSP_LIN_1.0.zip}} and do:
:{{cmdroot|cd NonGUI_Sample}}
:Edit {{path|main.c|}} and remove (or comment out) the line
#include "port/bioapi_port.h"
:then add the line
#include <stdlib.h>
:{{cmdroot|gcc -o Sample main.c -L/usr/local/lib -lbioapi100 -DUNIX -DLITTLE_ENDIAN}}
:{{cmdroot|./Sample}}
:Note that Sample may only run as root, unless you've already configured the usbfs file permissions.
:You can try to "e"nroll (to record a fingerprint for an account) and then "v"erify (to test a fingerprint against the one it expects for an account).
:You'll save a step later if you use your own login username as the username to enroll here.
:If running {{cmd |./Sample|}} produces the error message 'BioAPI_ModuleLoad failed, BioAPI Error Code: 6477 (0x194d)'
:then uncommenting the line
://BioAPI_SetGUICallbacks(gModuleHandle, NULL, NULL,TextGuiCallback, NULL);
:in {{path|main.c|}} can help.

==Login via pam_bioapi==

The following explains how to add fingerprint authentiation to programs that use the PAM (Pluggable Authentication Modules) framework, such as Gnome's GDM and KDE's KDM and screensaver.

===Getting required libs & tools===
====Installing pam_bioapi====
*Prerequisites
:On SuSE 10, I needed to install the pam-devel RPM
:In general, you will need pam itself (standard for most distros) as well as the pam development files (probably an optional package for your distro).
*Get and compile the pam_bioapi module.
{{HINT|A new version, pam_bioapi 0.3.0, with multi-finger and identification support can be found [http://www.nax.cz/pub/bioapi/pam_bioapi/pam-bioapi_0.3.0.tar.gz here].
There's work in progress. pam_bioapi and biometrics-manager can be downloaded [http://download.savannah.gnu.org/releases/pam-bioapi/ here].}}
:{{cmduser|wget http://www.qrivy.net/~michael/blua/pam_bioapi/pam_bioapi-latest.tar.bz2}}
:{{cmduser|tar xjf pam_bioapi-latest.tar.bz2}}
:{{cmduser|cd pam_bioapi-0.2.1}}
:{{cmduser|wget http://badcode.de/downloads/fingerprint.patch}}
:{{cmduser|patch -p0 < fingerprint.patch}}
:If you want to, review the patch. In general you should review all code you download and compile, if possible.
:{{cmduser|<nowiki>./configure --libdir=/lib && make </nowiki>}}
:and as root
:{{cmdroot| make install}}
{{NOTE|If you get a 'rpl_malloc' error in /var/log/auth.log when trying to use the fingerprint reader, redo these steps and remove the related term from Makefile after running ./configure. (FC3, Debian etch)}}
*If you get 'configure: error: cannot find required header: security/_pam_macros.h' and are on a Debian-like system, do "apt-get install libpam0g-dev" and try again. If you are using a Mandriva distribution, do "urpmi libpam0-devel" instead.
*If you get 'PAM [dlerror: /lib/security/pam_bioapi.so: undefined symbol: BioAPIMemoryFuncs]' error in your syslog, replace 'LIBS = ' line in {{path|libpam_bioapi/makefile}} with the following (of course, replace {{path|/opt/bioapi/}} with the path where you installed bioapi):
LIBS = -L/opt/bioapi/lib -lbioapi100 -lbioapi_mds300 -lmds_util
*Use the sample tool from the fingerprint reader to create {{path|<username>.bir}} (<tt><username></tt> '''must''' be the username you want to login with. gdm will probably break for any login name that has no .bir file).
*As root do:
:{{cmdroot|SERIAL<nowiki>=`BioAPITest | sed -ne "/Fingerprint/{n;n;s/^.*: $.\{9\}$$.\{4\}$$.\{4\}$$.\{4\}$$.*$/\1-\2-\3-\4-\5/gp}"` </nowiki>}}
:{{cmdroot|echo $SERIAL}} should print something like {{cmdresult|<nowiki>{5550454b-2054-464d-2f45-535320425350}</nowiki>}} now.
:If it does, do:
:{{cmdroot|mkdir -p /etc/bioapi/pam/$SERIAL}}
:{{cmdroot|cp <username>.bir /etc/bioapi/pam/$SERIAL}}
:If not, you might just try
:{{cmdroot|SERIAL<nowiki>={5550454b-2054-464d-2f45-535320425350}</nowiki>}}
:as this value is hardcoded into the UPEK docs.

===Configuring pam===
The following part is distribution specific. On {{Ubuntu}} or {{SUSE}} you can modify {{path|/etc/pam.d/common-auth}} (on {{Gentoo}} and {{Fedora}} it is {{path|/etc/pam.d/system-auth}}) to look like this:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
password sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_unix.so nullok_secure

----
For '''Gentoo'''-Users - this allows you to attempt a password first. If you simply press enter, it then prompts for a fingerprints. Create a file named {{path|/etc/pam.d/bioapi}}. This also means that remote services, such as SSH keep working:

auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/
auth required pam_deny.so

account required pam_unix.so

session required pam_limits.so
session required pam_unix.so

----

Now, simply replace "auth include system-auth" in all services that you wish to use fingerprint for with "auth include bioapi". For example, {{path|/etc/pam.d/kde}} by default contains

auth include system-auth
auth required pam_nologin.so

account include system-auth

password include system-auth

session include system-auth

Simply replace the first "system-auth" with bioapi and you can also get rid of KDE desktop lock with a fingerprint. If you do not wish to allow for "password fallback" then remove

auth sufficient pam_unix.so likeauth nullok

from {{path|/etc/pam.d/bioapi}}.

{{WARN|If su/sudo expects to receive the root password (SuSE 10), you need to have fingerprint settings for root (that is, copy in a root.bir as well as a your-username.bir). Otherwise, they get a segmentation fault. Which is a little unfortunate, given that you need to su or sudo to change your settings... }}
{{WARN|Not only SuSE 10 requires root.bir to be available for su to work. Just make sure you have root.bir when su is not working with your fingerprint reader but other applications are...}}
Note that sshd may pick up the fingerprint settings from {{path|/etc/pam.d/common-auth}}. I didn't want that, so I removed the "auth include common-auth" line from {{path|/etc/pam.d/sshd}} and replaced it with the lines that were originally in my {{path|/etc/pam.d/common-auth}}. That way most local services use the fingerprint reader, but sshd does not.

{{NOTE|su/sudo will call for your fingerprint even if you are remote via ssh. Pressing *CTLR-c* (or closing graphic window) will allow you the desired password option.}}

Another way to do this is to create a file ({{path|/etc/pam.d/bioapi|}} for example) which contains the {{cmd|pam_bioapi.so|}} lines, and explicitly {{cmd|@include|}} this '''before''' {{path|/etc/pam.d/common-auth|}} in the files for services which should use the fingerprint reader. In this case you should leave {{path|/etc/pam.d/common-auth|}} alone.

{{NOTE|This was discovered through trial and success, if it is plain wrong, wikorrect it, please.}}

In {{Fedora}} the original 'session' terms in {{path|/etc/pam.d/system-auth}} need to be kept.

{{HINT|The setup described above will/could affect remote ssh logins to also use biometric logins, which is a bit silly (who wants to remote ssh to the laptop, and then have to walk over to it and swipe your finger) To avoid that you can copy the default <tt>/etc/pam.d/system-auth</tt> to <tt>/etc/pam.d/sshd</tt> which will allow the sshd service to use the standard authentication procedure.}}

You can do some useful testing with [http://pamtester.sourceforge.net/ {{cmd|pamtester|}}], which calls the pam modules as if it were a program of your choice. Examples:
:{{cmdroot|pamtester xdm yourusername authenticate}}
:{{cmduser|pamtester xscreensaver yourusername authenticate}}
where {{cmd|yourusername|}} is your username. Note that {{cmd|pamtester|}} should run as root if and only if the program in question does.

===Application support===
The implementation of fingerprint scanning support in the relevant applications varies.

Here is the behaviour of the most common ones:
* In gdm enter your username and there should pop up an (ugly) image to swipe your finger and... magic - you can login without a password.
* kdm doesn't give any visual indication, other than that the cursor stops blinking. Just swipe your finger and hope it lets you log in.
* In xdm, enter your username and a blank password, then swipe (there is no popup as well). Identification support for xdm can be achieved with [http://www.nax.cz/pub/bioapi/2005/xdm/xdm_bio.patch this patch].
* The KDE screen saver in SUSE 10 requires you to enter an empty password (or select the correct user and then enter an empty password) in order to get the fingerprint prompt.
* For Fedora users, the redhat-config tools will crash if no root.bir presents. Also, there won't be any visual idication unless X server is properly configured for root to access. Just swipe your finger when the HDD stopped blinking or issue the following command in advance:
:{{cmduser|xhost +local:}}
* For RHEL4 users gdm, console (virtual terminal) logins and the xscreensaver all work

===kdm support===
To add graphical popup to kdm, you need following:
* Patch for pam_bioapi. This patch adds third parameter to {{path|pam_bioapi.so}} module, which is a name of file with additional environment variables that will be supplied to the UPEK driver.
:{{cmdroot|wget http://upir.cz/linux/patches/pam_bioapi-0.2.1-alter-environ.patch}}
:{{cmdroot|patch -p1 < pam_bioapi-0.2.1-alter-environ.patch}}
* Edit your {{path|Xsetup}} file (on SUSE 10 it's {{path|/etc/X11/xdm/Xsetup}}) and add these lines:
echo "XAUTHORITY=$XAUTHORITY" > /var/lib/xdm/kdm_env
echo "DISPLAY=$DISPLAY" >> /var/lib/xdm/kdm_env
* In {{path|/etc/pam.d/xdm}} file, add {{path|/var/lib/xdm/kdm_env}} as a third parameter for {{path|pam_bioapi.so}} module:
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/ /var/lib/xdm/kdm_env
* On Ubuntu simply do:
echo "DISPLAY=$DISPLAY" >> /var/lib/kdm/kdm_env
* If you have created /etc/pam.d/bioapi then modify:
auth sufficient pam_bioapi.so {5550454b-2054-464d-2f45-535320425350} /etc/bioapi/pam/ /var/lib/kdm/kdm_env

Please note, that this won't work if you have more than one Xserver.

==Make xscreensaver use the scanner==
If you are using Gentoo, you can get a portage overlay with the necessary patches here: http://www.zzamboni.org/brt/files/xscreensaver-fingerprint-overlay.tar.gz
*Get the needed xscreensaver sources:
:{{cmduser|wget http://www.jwz.org/xscreensaver/xscreensaver-4.23.tar.gz}}
:{{cmduser|tar xzf xscreensaver-4.23.tar.gz}}
:{{cmduser|cd xscreensaver-4.23}}
:{{cmduser|wget http://www.nax.cz/pub/bioapi/2005/xscreensaver/xscreensaver-4.22_alternativeAuth.diff mirror: http://zepan.org/files/xscreensaver-4.22_alternativeAuth.diff For xscreensaver 5.00, you can get a patch here: http://www.zzamboni.org/brt/files/xscreensaver-5.00-alternativeauth.patch}}
*After reviewing the patch (it's small and straightforward), do
:{{cmduser|patch -p1 < xscreensaver-4.22_alternativeAuth.diff}} The patch prevents xscreensaver from opening an authentification window and dispatches the authentification request to another program, in our case <tt>pam</tt> and <tt>pam_bioapi</tt>. It should apply with some offset, don't mind that. If it says something about rejected though, then there's a problem.
*Compile with
:{{cmduser|./configure --with-pam && make}} 
*If you receive an error like "Couldn't find X11 headers/libs" and are running a Debian-like system, try "apt-get install xlibs-dev"
*If you receive an error like "undefined reference to `XmuPrintDefaultErrorMessage'" then install the libxmu-dev package and run the previous line again and then install as root with
:{{cmduser|su -c make install}} .
*Make sure that the newly compiled xscreensaver is used:
:{{cmduser|which xscreensaver}} should return
:{{cmdresult|/usr/local/bin/xscreensaver}} .
*In case it doesn't, try adjusting your PATH.

==Common problems==
===Bioapi error #3===
This is sometimes caused by improper permissions.

However, at least on Gentoo, recent upgrades to glibc and gcc 4.1.1 caused Bioapi to break down due to some sort of incompatibility with bioapi registry. Reinstalling does '''not''' repair the issue automatically. However, you can still fix the issue manually, by removing /var/bioapi. You need to reinstall tfm-fingerprint driver after reinstalling bioapi so that the driver is properly re-registered. As root, type

:{{cmdroot|emerge -C bioapi}}
:{{cmdroot|rm -rf /var/bioapi}}
:{{cmdroot|emerge -av1 bioapi tfm-fingerprint}}

Talk:BIOS Upgrade

2007-02-18T04:49:56Z

Jamesavery: Dead link for FreeDOS floppy

== Dead link ==

The link to the FreeDOS floppy (http://www.ankreuzen.de/freedos/files/fd9sr1/fdos1440.zip), which is needed to upgrade the BIOS from a CD, is dead. Is the information still valid? And is there a different source for the floppy image? [[User:Jamesavery|Jamesavery]] 05:49, 18 February 2007 (CET)

== BIOS upgrade using WINE ==

Does anyone think this would be possible? [[User:Mcalwell|Mcalwell]] 08:58, 28 January 2007 (CET)

: No this is not possible. [[User:Mcalwell|Mcalwell]] 16:01, 12 February 2007 (CET)

== BIOS upgrade without battery ==

Concerning the known problem with 600 series with batteries dead too soon, it is impossible to upgrade the bios without the battery because the original ibm update program doesn't allow this. I bought an old 600E without the battery. There was one workaround, but i think for the older releases of the bios, where you just extracted files and upgraded manualy, bypassing the ibm install program. The page that describes this (i lost the link) has a list of different files, that the ones found in current release so i never did figure out what to do? I would like to upgrade because i have really old bios, where ACPI doesn't cooperate so well with the operating system, either windows or linux.

If somebody finds a workaround please help. Thanks

//Edit

I've found the page on Vim's bios upgrade forum.. I don't know if it exactly for my model, since the files differ.. '''Is it possible, to upgrade bios in linux without the battery?'''

''I have found a working solution WOW on the other forum:

*** This is NOT a safe way to update the bios (disclaimer) ***

* First you need to make a BIOS update floppy disk (from the bios file from IBM - place disk in a: drive, run app and answer Y to the agreement) and then format another disk by right clicking on A: - format - make system bootdisk (assuming you have another machine spare)

* Copy all the files from the IBM Boot disk - in my case
$0029000.fl1
$0029000.fl2
FLASH2.EXE
PROD.DAT
UPDTFLSH.EXE
updtrom.exe
USERINT.EXE
UTILINFO.EXE
to the other clean bootdisk.

* Ensure that there is no config.sys and autoexec.bat so it just runs straight into DOS.

* Place the disk into the Laptop, reboot and allow the machine to load via the floppy

* At the command prompt, type "FLASH2.EXE /U" with no quotes then press enter.

The program will automatically search for the files *.FL1 & *.FL2 and load the bios first then the platform file.

The program will automatically update and perform erasing on the rom and then finish with "Update complete".

* Now reboot.

* Hold F1 down as you turn the laptop back on and go into Easy Setup under "Config" click on Initialize to ensure defaults and settings are error free.

* Save and exit...''

// EDIT

This worked on my machine.. I make no guarantees it will work on others.

The above procedure did not work on my T23 using the 1.20 bios; it kept returning error 14 (Low Battery). However, following those instructions and running "qkflash" rather than flash2 did work for the main bios, and later for the embedded controller.

--grythumn

== Bios upgrade & hidden partition ==

I have disabled the hidden partition to make more space for linux (24G). I still have Windows on the 14G partition. Is it safe to upgrade the BIOS without the hidden partition? I want to get a newer BIOS to fix the annoying fan issue. Thanks

- yes don't worry about it. bios upgrades have nothing to do with whats inside the harddrive.

== BIOS upgrade over PXE ==

Hi,

I have a Thinkpad X20 with a very early BIOS and Embedded Controller Program which I'd like to update. Currently, the only feasible way of doing this is over the network using PXE. I already have a fully functional PXE server using SYSLINUX, and have so far been able to boot the BIOS diskette image using MEMDISK, although I have not attempted to flash anything yet due to the warnings given on the page. Is there any safe way I can update both the Controller Program and the BIOS in the same session over the network in this manner? If not, what other methods would be suitable? I have a USB CD-ROM drive and could probably get hold of a USB floppy drive.

Thanks.

Update: I ended up burning CDs as described and successfully updated everything. I'd still like to know if there is a way I could do it entirely over the network, though.

== RE: grub initrd ==

"Another possibility which works even without a CD-drive or network is to boot the disk image via the grub initrd mechanism."

0) Interesting suggestion. Might be better of in its own section.

1) Could you please elaborate?

2) My first guess (pending your elaboration) would be to "chainload" the first block of the diskimage using the grub commandline, like:
blocklist (''path'')/''to''/''diskimage''
chainloader ''blockvalue''+1

But that's just a guess!

[[user:Pebolle|Paul Bolle]] Fri Jul 15 12:20:47 CEST 2005

== bios/controller update sequence ==

The article says:
"If you go through the readme's on the IBM site they'll cleary state that you must update the Control Program first, then imediately update the BIOS"

When I look at the IBM udpate instructions for the T23, it says:
"If you need to update the BIOS as well as the Embedded Controller Program, update the BIOS first."

Comments?

> I would first contact IBM for clarification, but you should probably be following instructions specific to your model.

>> I did it following IBM's instructions to upgrade the BIOS first. Everything worked out great!

== Firmware upgrade for Intel minipci combo card ==

I just purchased an [[Intel 10/100 Ethernet Mini-PCI Adapter with 56K Modem]] that has an ancient (2.0.6) firmware version. I Downloaded the update file intlbtag.EXE but cabextract was unable to find any cabfiles inside it. I tried running the program via wine and that didn't work either.

Finally I ran the program on a windows machine and created a boot floppy. Then I went through the the process of converting the floppy to a bootable cd via linux and that worked like a charm. The cd successfully updated the minipc card's firmware.

Everything worked but I ended up needing a windows box to do it. Could this have been done without windows?

== Firmware upgrade for Wireless LAN MiniPCI COMBO Card using prism2_srec ==

The appropriate firmware installation program for the wlan card in my R32 can be extracted using cabextract as described in the article. It contains (besides some installation programs) a disk image (1awg06ww.IMG) that seems to be a simple dos boot disk. This image contains 3 .hex files (id010001.hex, pk010100.hex, sf010402.hex) that are recognized by prism2_srec to be "srec"-files. Trying to load them to RAM yields:

{{cmdroot|prism2_srec -v -r wlan0 sf010402.hex}}
S3 CRC-16 generation record: start=0x007E1800 len=65642 prog=1
Start address 0x00000000
srec summary for sf010402.hex
Component: 0x001f 1.4.2 (station firmware)
<snip>
Interface compatibility information:
role=Supplier variant=2 range=1-9 iface=Station Firmware-Driver (4)
role=Actor variant=1 range=1-1 iface=Modem-Firmware (1)
role=Actor variant=2 range=1-1 iface=Controller-Firmware (2)
role=Actor variant=1 range=4-4 iface=Primary Firmware-Driver (3)
<snip>
Wireless LAN card information:
Components:
NICID: 0x8013 v1.0.0
PRIID: 0x0015 v1.0.7
STAID: 0x001f v1.3.6
Interface compatibility information:
PRI role=Supplier variant=1 range=1-1 iface=Modem-Firmware (1)
PRI role=Supplier variant=2 range=1-1 iface=Controller-Firmware (2)
PRI role=Supplier variant=1 range=4-4 iface=Primary Firmware-Driver (3)
STA role=Supplier variant=1 range=1-9 iface=Station Firmware-Driver (4)
PRI role=Actor variant=2 range=1-1 iface=Controller-Firmware (2)
STA role=Actor variant=2 range=1-1 iface=Controller-Firmware (2)
STA role=Actor variant=1 range=1-1 iface=Modem-Firmware (1)
<snip>
This image is not meant to be downloaded to volatile memory.
Incompatible update data.

Has anyone tried to flash this device using prism2_srec yet?
What bothers me is, that the upgrade is for many different parts of the combo card. Does anyone have an opinion on whether this could work?

OK, I took the risk and successfully upgraded my station firmware, BUT when I tried to upgrade the primary firmware the system froze!!! The thinkpad won't start up with the miniPCI card inserted and all efforts to reflash it using the original DOS boot image failed!!!

I'm quite sure the system freeze was not caused directly by prism2_srec, because I have noticed rare system freezes since I have been using my PCMCIA wireless card.
Anyway, if anyone should own a TP R32, I'd be glad if he could tell me the base address of the Wlan card, or it's PCI address.

Thinkpad r32 owner here. I want to upgrade the firmware as well. If you need any information just send an email to haftbar[a]gmail.com [[User:Quickie|Quickie]] 02:12, 1 February 2006 (CET)

==Reorganization suggestion==
The Downloads section is rather long. Would it be an idea to put it on a separate, new page (say: BIOS_Downloads) and link to that new page from this page?

[[User:Pebolle|Paul Bolle]] 21:27, 15 Oct 2005 (CEST)

> I agree with this suggestion.

== Upgrading BIOS and Embedded Control Program from Win XP ==

I'm trying to upgrade the BIOS and Embedded Controller Program from Windows XP following the instructions on the Lenovo website. The problem is the instructions are not very clear about this. The instructions basically state that I must upgrade them at the same time because the Control Program does not work with the older BIOS and the BIOS does not work with the older Control Program. They also state that I should upgrade the Control Program first.

But that means I must boot into XP after having upgraded the Control Program but with the older BIOS in order to then update the BIOS. But if this works then they are actually compatible and there's a contradiction. Am I missing something? I just want to make sure I don't end up with a non-functioning unit.

I have an X23 and want the latest BIOS (v 1.32) and Control Program (v 1.30).

Maybe there should be a note about this in the article? Or maybe I'm the only one who is this stupid :)

Update: I talked to Lenovo support. The situation apparently is that though the description says that the newer control program is not compatible with the older BIOS, they are not so incompatible as to cause the machine to stop working so it is actually possible to use incompatible versions of BIOS and control program. In fact according to the support person it makes no difference if the BIOS is upgraded before the control program or vice versa. So I upgraded the control program using the executable running in Windows XP, which rebooted the computer to perform the upgrade and then I booted Windows again to upgrade the BIOS in the same manner and it all worked fine. If anyone reading this finds it useful maybe you can put it in the article? Or if you find it superfluous just delete this section.

== BIOS upgrade for T21 with T20 BIOS ==

Hi, I bought a used T21 recently (type 2647-8AU), and would like to update the BIOS to the latest version, but there's a problem: this T21 appears to have a T20 BIOS (IYET50WW, a/k/a T20 BIOS version 1.11). When I try updating this BIOS using one of IBM's T21 updaters - I tried KZET34WW/v1.16 (the latest one) and KZET16WW/v1.01 (the earliest one) - I get the following message:

<blockquote>
''The diskette in the default drive will not run on this system. Your system is now locked. To restart your system, press Ctrl+Alt+Del.''
</blockquote>

I suspect this message appears because the existing BIOS is a T20 BIOS.

There would appear to be two options: either use the most recent T20 updater (IYET61WW, a/k/a T20 v1.22), or find a way to defeat the block in the KZET34WW/v1.16 T21 updater. Obviously either option is risky in the absence of more information and/or detective work. And I don't know enough about T2x-series hardware to hazard a guess (i.e., were early T21s just T20s with a speed bump, did some T21s get T20 BIOSes by mistake due to factory error, or are the T20 and T21 similar enough that it doesn't matter whether a T20 or T21 BIOS is used).

Some relevant data gleaned from the stickers on the case bottom and the current BIOS:

<blockquote>
* '''Type:''' 2647-8AU (T21 with 800-MHz processor)
* '''S/N:''' 78-0GL1Z (zero-G-L-one-zed)
* '''Manufacture date:''' 03/2001
* '''BIOS version:''' IYET50WW (T20 BIOS v1.11)
* '''System unit S/N:''' (appears to be blank)
* '''System board S/N:''' J1HHS15CL5C
* '''System board P/N:''' 08K3747 (printed on motherboard)
</blockquote>

Thanks for any help anyone can provide.

-Linux Spice

P.S. At first I thought this might be a Frankenstein ThinkPad with a T21 case and a T20 logic board - I did buy it used, after all - but it does have an 800-MHz processor, which was never an option for the T20 (both the BIOS and Linux report it as such), and all the other equipment checks out (except for the hard drive, which was replaced with a 40-GB model).