ThinkWiki - User contributions [en]

Category:X200

2008-08-28T00:39:05Z

Ryanc: /* Standard Features */

{| width="100%"
|style="vertical-align:top" |
=== ThinkPad X200 ===
This page gives an overview of all ThinkPad X200 related topics.

<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
==== Standard Features ====
* One of the following processors:
** [[Intel Core 2 Duo]] P8400, 2.26Ghz, 3MB L2, 1066Mhz FSB
** [[Intel Core 2 Duo]] P8600, 2.40Ghz, 3MB L2, 1066Mhz FSB
* [[Intel Graphics Media Accelerator 4700 MHD]] onboard graphics
** 12" CCFL with 1280×800 (WXGA, 200 nit)
* Support for up to 5GB DDR3-RAM [[PC3-8500]]
** As of 27 Aug 2008, 4GB option is most available and '''only''' if you select upgrade to Windows Vista Business 64
* One of the following hard drives:
** 80,160,250 GB SATA 2.5" 5400/7200RPM
** 320 GB 5400RPM
** 200 GB Sata 2.5" 7200RPM with [[Full Disk Encryption (FDE)]]
** 64 GB SATA 1.8" SSD
* ThinkPad X200 Ultrabase
** DVD-ROM, CD-RW/DVD-ROM, DVD Burner, Blu-ray
* One of the following expansion slots:
** 5-1 Media card Reader with Modem
** 3-1 Media card Reader without Modem
* [[Ethernet Controllers#Intel Gigabit (10/100/1000)|Intel Gigabit Ethernet Controller]]
* [[MiniPCI Express slot]] 1 with one of the following:
** [[ThinkPad 11b/g Wireless LAN Mini-PCI Express Adapter III]]
** [[Intel Wifi Link 5100 (AGN)]]
** [[Intel Wifi Link 5300 (AGN)]]
* [[MiniPCI Express slot]] 2 with one of the following:
** Integrated WWAN with GPS
** Integrated Ultra Wide Band (UWB) for AT&T
** Integrated Ultra Wide Band (UWB) for Verizon
** WiMAX (late 2008)
** [[Intel® Turbo Memory hard drive cache]] 2GB
* Optional Features
** Integrated camera
** Integrated digital microphone
** Security cable slot
** [[Integrated Fingerprint Reader]]
* [[ThinkPad_Bluetooth_with_Enhanced_Data_Rate_(BDC-2)|Bluetooth]]
* [[Embedded Security Subsystem|IBM Embedded Security Subsystem 2.0]]
* [[Active Protection System|IBM Active Protection System]]
* TrackPoint '''only'''
* One of the following batteries
** 4-cell battery, up to 3.3 hr, 1.34kg
** 6-cell battery, up to 6.5 hr, 1.47kg
** 9-cell battery, up to 9.8 hr, 1.63kg (protrudes out back 22.8cm/.9in)
</div>

==== Resources ====
* [http://shop.lenovo.com/ISS_Static/merchandising/US/PDFs/x200_datasheet.pdf X200 Technical Specifications (pdf)]

==== Reviews ====
* [http://www.notebookreview.com/default.asp?newsID=4497 Notebookreview.com] 2008-07-15
* [http://www.laptopmag.com/review/laptops/lenovo-thinkpad-x200.aspx Laptopmag.com] 2007-07-14
* [http://reviews.cnet.com/laptops/lenovo-thinkpad-x200/4505-3121_7-33184078.html Cnet.com] 2008-08-14

[[Category:X Series]]

Template:X Series

2008-08-28T00:35:25Z

Ryanc:

{{X20}}, {{X21}}, {{X22}}, {{X23}}, {{X24}}, {{X30}}, {{X31}}, {{X32}}, {{X40}}, {{X41}}, {{X41_Tablet}}, {{X60}}, {{X60s}}, {{X60_Tablet}}, {{X61}}, {{X61s}}, {{X61_Tablet}}, {{X200}}

MiniPCI Express slot

2008-08-28T00:32:43Z

Ryanc: /* Models featuring this Technology */

{| width="100%"
<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
A MiniPCI Express slot is a version of the PCI-Express x1 slot for Notebooks

</div>
|}
__NOTOC__

=== MiniPCI Express Adapters ===
* [[Intel PRO/Wireless 3945ABG Mini-PCI Express Adapter]]
* [[Intel PRO/Wireless 4965AGN Mini-PCI Express Adapter]]
* [[Intel Wifi Link 5100 (AGN)]]
* [[Intel Wifi Link 5300 (AGN)]]
* [[ThinkPad 11a/b/g/n Wireless LAN Mini Express Adapter]]
* [[ThinkPad 11a/b/g Wireless LAN Mini Express Adapter]]
* [[ThinkPad 11b/g Wireless LAN Mini-PCI Express Adapter III]]
* [[Verizon 1xEV-DO WWAN]]

=== (In)Compatibility ===
Though the slot is MiniPCIe in form factor, it has been crippled to only accept devices with PCI-ID's contained in a BIOS whitelist consisting of the above list of devices (likely not exhaustive and varying depending on the particular system) with the additional requirement that they '''must carry the Lenovo brand name and consequently cost twice as much'''. If an unauthorized card is plugged in it gives a <tt>1802</tt> error on initial boot up before it even touches the operating system. (see [[Problem with unauthorized MiniPCI network card]], [http://forum.notebookreview.com/showthread.php?t=69445 1802 with MiniPCIe on t60],[http://forums.lenovo.com/lnv/board/message?board.id=T_Series_Thinkpads&message.id=274 same]). The workarounds on the first link concerning MiniPCI devices may or may not be directly applicable to the MiniPCIe slot. Anyone who has added non-Lenovo components to this slot either successfully or unsuccessfully is encouraged to provide any relevant details here.

=== Linux support ===
MiniPCI Express adapters are handled by the Linux PCI subsystem.

=== Models featuring this Technology ===
* ThinkPad {{T60}}, {{T60p}}, {{R61}}, {{T61}}, {{T61p}}
* ThinkPad {{X60}}, {{X60s}}, {{X61}}, {{X61s}}, {{X200}}
* ThinkPad {{Z Series}}, {{Z61m}}

[[Category:Components]]

=== External sources ===
* Lenovo [ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/accessories_guide_us_can_dec2007.pdf accessories guide].

Integrated Fingerprint Reader

2008-08-28T00:32:06Z

Ryanc: /* Models featuring this Technology */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;" | [[Image:fingerprintreader.jpg|IBM Integrated Fingerprint Reader]] __NOTOC__
|style="vertical-align:top" |
<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
===Integrated Fingerprint Reader===
IBM released a second generation of T42 models in Autumn 2004 featuring Intel Pentium M 765 processors and an integrated fingerprint reader.

The fingerprint reader is produced by a company called UPEK, which specializes in the manufacture of fingerprint readers. It is integrated as an USB device, and does all the matching in hardware, making it rather easy to use. Furthermore, IBM states that there's an interface with the [[Embedded Security Subsystem]]. UPEK now sells the fingerprint reader as a USB peripheral bundled with the same underlying software for accessing password-protected online accounts and Windows: [http://www.upek.com/solutions/eikon Eikon Digital Privacy Manager]

However: The fingerprint reader is an INSECURE device and gives a false sense of security! There has been quite a bit of research by a hacker named Starbug, a member of the Chaos Computer Club, Berlin, Germany. He outlined in two very good talks how to forge each and every available fingerprint sensor available at the cost of a few euros, using materials from your local hardware store, a digicam and a laser printer! Here's some links:
* [http://www.ccc.de/updates/2007/umsonst-im-supermarkt?language=en Fingerprint recognition in supermarkets]
* [ftp://ftp.ccc.de/pub/video/Fingerabdruck_Hack/fingerabdruck.mpg?language=en Video tutorial for forging fingerprints]
Remember, using fingerprints for authentication is much similar to having a password which is written on anything you touch.

==Open Source==

There is a new GPL driver at http://thinkfinger.sourceforge.net; see the [[How to enable the fingerprint reader with ThinkFinger]] for detailed instructions. This is the recommended option as it integrates more seamlessly with PAM and doesn't produce a tacky graphical prompt.

{{HINT|If you've followed the instructions and "tf-tool --verify" works, but nothing else does, make sure that the "uinput" module is loaded.}}

Newer variants of the {{R61}} require a different driver. This newer fingerprint reader [http://www.reactivated.net/fprint/wiki/Upeksonly device] sits on the USB bus with USB ID 147e:2016. An open source driver has been developed by [http://www.reactivated.net/fprint/wiki/Main_Page the fprint project]. Installation instructions can be found at [http://knowledge76.com/index.php/Fingerprint_Reader_Installation System76].

==Binary Only==
A closed source driver from the vendor has been released. It interfaces to the hardware as a user-space USB driver through {{path|/proc/bus/usb|}} and provides a BioAPI 1.10 device, which can then be interfaced to pam for authentication by user programs. The driver can be downloaded from http://www.upek.com/support/dl_linux_bsp.asp; see the [[How to enable the fingerprint reader|corresponding HOWTO]] for detailed instructions. It however tends to be less stable than the above opensource driver.

==Related Links==
* [http://www.trustedreviews.com/article.aspx?page=1643&head=36 Review from TrustedReviews of the fingerprint scanner]
* [http://biomark.org.ru/en/ A (Russian) project that provides support for a (different model) of fingerprint scanner] (also a USB device, though)
* [http://www.upek.com/support/pdf/UPEK_flyer_TCS3_TCD4.pdf TouchStrip TCS3/TCD4 spec sheet]
* [http://www.qrivy.net/~michael/blua/ A branch of the BioAPI reference implementation]
* [http://www.reactivated.net/fprint/wiki/Main_Page fprint project]

==Models featuring this Technology==
*ThinkPad {{R52}}, {{R60}}, {{R61}}
*ThinkPad {{T42}}, {{T42p}}, {{T43}}, {{T43p}}, {{T60}}, {{T60p}}, {{T61}}, {{T61p}}
*ThinkPad {{X41}}, {{X41T}}, {{X60}}, {{X60s}}, {{X61s}}, {{X61_Tablet}}, {{X200}}
*ThinkPad {{Z60m}}, {{Z60t}}, {{Z61m}}, {{Z61p}}, {{Z61t}}

[[Category:Glossary]]

Active Protection System

2008-08-28T00:31:48Z

Ryanc: /* Models featuring this Technology */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;" | [[Image:APS.jpg|IBM Active Protection System]] __NOTOC__
|style="vertical-align:top" |
<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
=== The Active Protection System ===
With the new series of ThinkPads IBM introduced the Active Protection System (APS) in 2003. The APS is a protection system for the ThinkPad's internal harddrive. A sensor inside the ThinkPad recognizes when the notebook is accelerated. A software applet then is triggered to park the harddisk. This way the risk of data loss in case of when the notebook is dropped is significantly reduced since the read/write head of the harddrive is parked and hence can't crash onto the platter when the notebook drops onto the floor.

The hardware sensor is capable of not only recognizing acceleration of the notebook, but also (to a certain degree) of its whole orientation in space, relative to gravity's axis. Furthermore, having the actual control put into software, its functionality is extendable and it gives chance to implement features like the "ignore minor shocks" feature which is present in the Windows based control applet. (This feature prevents the harddrive from parking in case of minor regular shocks such as occur when in a train or car.)

The measurements are physically performed by an [[Analog Devices ADXL320 accelerometer]] chip, managed by the [[Embedded Controller Chips|embedded controller]].
</div>
|}

* [ftp://ftp.software.ibm.com/pc/pccbbs/mobiles_pdf/aps2mst.pdf IBM Active Protection System Whitepaper]

==Hard-disk Support==

HD-APS requires a hard-disk with [http://www.hitachigst.com/hdd/research/storage/hdi/loadunload.html head unload ramp technology] and also support on the hard-disk firmware to unload heads without flushing the disk cache. This is required, because as soon as the APS system detects a shock is imminent, the system has less than 500ms to prepare for the shock.

Unloading heads without flushing the cache is done using the [http://www.t13.org/Documents/UploadedDocuments/docs2003/e03120r5.pdf optional Unload Immediate feature of the IDLE IMMEDIATE ATA command]. It finishes whatever sector write is in-flight, and immediately moves the heads to the unload ramp. Without this command, hard-disk APS cannot be trusted, as disks with big caches can take a lot of time to write it all to disk.

So far, only hard-disks with IBM APS firmware, as well as the consumer Fujitsu HV2060AH/MHV2100AH/MHV2120AH HDs have been found to implement all the necessary functions. Head unload technology is reasonably common in modern laptop disks, but the APS firmware is very rare in regular consumer products. Please note that newer Apple notebooks also support APS, so it is somewhat likely that their disks also support unload immediate or a similar feature.

==Linux Support==
Linux support is in development.

This feature definitely depends on software and there is no hardware or BIOS only way of making it work.
IBM made contradictory statements about their willingness to release the specifications of the hardware sensor and its API to the linux community or some developers. Although a lot of developers and other interested people from the OpenSource community actively contacted IBM to get the specs, in fact they never got them.

However, after first efforts of [http://www.kernelthread.com/software/ams/ Amit Singh on a PowerBook] and [http://www.almaden.ibm.com/cs/people/marksmith/tpaps.html Mark Smith on a ThinkPad], the [[HDAPS]] project was founded to produce a linux kernel driver for the acceleration sensor and a user space application to monitor it. Later, a kernel patch to enable harddisk parking followed.

See [[How to protect the harddisk through APS]] for instructions and [[Problem with APS harddisk parking]] for Troubleshooting.

Furthermore, a list of alternative applications like theft alarm and others can be found on the [[HDAPS]] driver page.

==Tilt detection field tests==
Using Perl code for WinXP:
<pre>
use Win32API::File qw(:ALL);
sub get_tilt {
my $file = createFile("//./ShockMgr", "r ke") or die "Can't get ShockMgr device";
DeviceIoControl($file, 0x733fc, [], 0, my($buf), 0x24, my($bytes), []);
my @data = unpack "x4s*", $buf;
return @data[1, 0];
}
</pre>
my T42 gives values of roughly 490 when at rest in normal upright position with base parallel to the ground. As I gently tilt the T42 through all possible x or y angles, the values range from about 335-645, meaning a resolution of about 155 units per Earth gravity. This seems to suggest that the operating range of the APS is actually about +-3 gs, although the ADXL320 is supposed to allow +-5 gs.

As the tilt angle is the arcsine of the normalized APS reading, the Thinkpad is most tilt sensitive when in a normal upright position with base parallel to the ground. In this position, the tilt resolution is about 0.35 - 0.4 degrees. At maximum tilt, the resolution is much worse, about 6.5 degrees.

Shouldn't matter much, but my tests are at an elevation of about 60 meters above sea level.

===More field tests===
When placed on a reasonably flat and reasonably horizontal work surface my T43 provides readings of about x=503 and y=569. I wrote a command-line application in C# (using the .NET DllImport annotation to access the sensor.dll API) to log the sensor readings at some interval. With 150ms sampling I found the following extreme values: 335 to 654 for x, and 409 to 723 for y.

<pre>
x: 494.5 +/- 159.5
y: 566.0 +/- 157.0
</pre>

Based on the maximum and minimum x and y readings I calculated the above "zero" and range values in order to convert the sensor readings to degrees and wrapped this up in a small graphical application for Windows. My data, source code, executables and a complete description can be found [http://www.stanford.edu/~bsuter/thinkpad-accelerometer/ here].

==Related Links==
*[http://www.stanford.edu/~bsuter/thinkpad-accelerometer/ Sensor Data, Calibration, command-line and GUI executables for Windows and C# .NET source code]
*[http://www.ibm.com/developerworks/blogs/page/johnston?entry=python_and_thinkpad Python and ThinkPad, a Python script for Windows to access the sensor data]
*[http://www.pc.ibm.com/presentations/us/thinkvantage/56/index.html?shortcut=aps& IBMs ThinkVantage™ Technologies Flash presentation - Active Protection System]
*[http://www.musatcha.com/software/LaptopTheftPrevention/ Motion-Sensitive anti-theft alarm for ThinkPads with APS]
*[http://www-128.ibm.com/developerworks/linux/library/l-knockage.html?ca=dgr-lnxw01Knock-Knock IBM HDAPS/Linux HDAPS information page]
*[http://hdaps.sourceforge.net HDAPS project page]
*[http://sourceforge.net/mailarchive/forum.php?forum=hdaps-devel HDAPS-devel list archive]

==Models featuring this Technology==
*ThinkPad {{R50}}, {{R50p}}, {{R51}}, {{R52}}, {{R60}}, {{R61}}, {{R61i}}
*ThinkPad {{T41}}, {{T41p}}, {{T42}}, {{T42p}}, {{T43}}, {{T43p}}, {{T60}}, {{T60p}}, {{T61}}, {{T61p}}
*ThinkPad {{X40}}, {{X41}}, {{X41_Tablet}}, {{X60}}, {{X60s}}, {{X60_Tablet}}, {{X61}}, {{X61s}}, {{X61 Tablet}}, {{X200}}
*ThinkPad {{Z60m}}, {{Z60t}}, {{Z61m}}, {{Z61t}}, {{Z61e}}

[[Category:Glossary]]

Embedded Security Subsystem

2008-08-28T00:31:31Z

Ryanc: /* IBM Embedded Security Subsystem 2.0 */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;" | [[Image:ESS.jpg|IBM Embedded Security Subsystem]] __NOTOC__
|style="vertical-align:top" |
<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
=== The Embedded Security Subsystem ===
The Embedded Security Subsystem is a chip on the ThinkPad's mainboard that can take care of certain security related tasks conforming to the TCPA standard. It was first introduced among the T23 models and is now under the name "Embedded Security Subsystem 2.0". It is an integral part of most of the modern ThinkPads. The functions of the chip are fall into three main groups:
* Public key functions
* Trusted boot functions
* Initialization and management functions

The purpose of the Embedded Security Subsystem is to keep the user's sensitive data out of range from software based attacks (like viruses, Internet attacks etc.). One way the chip offers to achieve this is by providing storage for keys along with the necessary functions to handle them within itself, so that a for example a private key never has to leave the chip (can't be seen by any piece of software). Besides this, there are more complex topics covered by the functionality of the chip. If you want to find out more about it you can find good documents on the [http://www.research.ibm.com/gsal/tcpa/ IBM Research TCPA resources page].</div>
|}

{{NOTE|Some ThinkPads have the TPM chip integrated into the SuperIO chip, and in a not-so-distant future, the TPM will be integrated into the chipset. Don't let the picture fool you...}}

{{WARN|There's a bug in the latest release of the security chip software. You end up facing a security chip login, and you press Ctrl-alt-delete, and it just sits there. '''Do not''' download the latest patch (Dated 13/06/2006 v 7.00.0017.00) <BR>
Actually, they appear to have removed that patch.<BR>
Ring IBM support (in Australia 131426, 1, 2) and they'll talk you through doing a system restore.}}

==Trusted or Treacherous?==

TC - Trusted Computing - will be the biggest change of the information landscape since decades. Besides positive features like a more secure hardware storage for cryptographic keys, an analysis of the proposed TCG-standards shows some problematic properties. <br />
As ThinkPads of recent generations following the ThinkPad {{T23}} ([[Embedded Security Subsystem#Models featuring this Technology|see the complete list of models]]) are equipped with this disputed TCG-/TCPA-Technology, it can be interesting, which promises of the TCG are fulfilled inside your ThinkPad and which parts of the TCG-specifications still seem to be a privacy issue for every user of digital devices like a MP3-player or a ThinkPad - so please read [[TCPA/TCG - Trusted or Treacherous|this article]] for more details.

==Linux Support==
Two linux drivers are available, a [[tpm|classical one]] and a [[tpmdd|newer one]].
Coverage of functionality of the first is unknown so far, the second is part of a bigger project aiming to provide a usable security framework.

David Stafford (one of the developers of the tpm code at IBM) on March 10, 2005 sent me the most recent version of the tpm-kml code. With his permission, I quote his email:

"I am attaching our latest driver and library.
This version is in the process of kernel mailing list review, and
will hopefully be accepted into the official kernel. It works
much better across various 2.6 kernels. Note that this builds
three modules tpm, tpm_atmel, and tpm_nsc. You modprobe the
tpm_atmel (for all current shipping atmel based systems), or
tpm_nsc (for the coming national based systems).

Also note that there is a conflict with the snd-intel8x0
kernel module (they each try to grab the LPC bus). You can
either: load the tpm modules first (such as in initrd or
rc.sysinit, before sound), or recompile the snd-intel8x0, turning
off the MIDI and JOYSTICK support. The latest 2.6.11 version
of snd-intel8x0 also reportedly fixes things."

Compiling this library was easy. Compiling the driver on my 2.6.8-686 (debian testing) laptop failed. But the library works with the driver I compiled from the tpm-2.0 package IBM made available on its pages (see the links below).

Gijs

The T43 requires a patch posted to the LKML by Kylene Jo Hall: [http://marc.theaimsgroup.com/?l=linux-kernel&m=111884603309146&w=2 LKML posting]. An updated patch for linux 2.6.12 is available [http://shamrock.dyndns.org/~ln/linux/tpm_2.6.12.diff here].

The atmel driver comes with 2.6.12.
----
Now suported in 2.6.15.1 (and maybe others kernels under this number) in:

/device drivers/caracter devices/tpm devices

==Versions & Features==
=== Embedded Security Chip ===
IBM introduced it's TCPA/TCG features with some of the [[:Category:T23|T23]] models. The earlier of them didn't yet have the Embedded Security Subsystem, but a kind of pre 1.0 version called the Embedded Security Chip. This chip had the following capabilities:
*Data communications authentication and encryption
*Storage of encrypted passwords

=== Embedded Security Subsystem (1.0) ===
The original Embedded Security Subsystem (in IBM documents there is no use of the additive version-number 1.0) claims to be compliant with TCG specs, but apparently did not fully implement any specific TCG spec.

The Embedded Security Subsystem has the following features:
*hardware key storage
*multi-factor authentication
*local file encryption
*enhances VPN security

=== Embedded Security Subsystem 2.0 ===
The Embedded Security Subsystem 2.0 conforms to the TCG TPM 1.1b specification, with a TPM manufactured by either Atmel or National Semiconductor, and TCG TPM PC client 1.1 BIOS extensions.

The Embedded Security Subsystem 2.0 has the following features:
*hardware key storage
*multi-factor authentication
*local file encryption
*enhances VPN security
*TCG compliant

National Semiconductor TPMs are likely part of the Winbond SuperIO chip (e.g. in a {{T43}}).

{{NOTE|It is possible that second-generation T60s and the T61/X61/R61 have TPM chips conforming to TCG TPM 1.2. If you own one, please verify if that's true, and update this page}}

==Clearing/Reseting the Embedded Security Subsystem==

{{WARN|Be sure that there are no active HDD passwords, and that you have uninstalled any IBM/Lenovo security software that might want information stored or encrypted with the help of the TPM chip '''before''' you clear the chip. Any data that is encrypted using information inside the TPM chip will be useless after you clear the TPM chip. It is unknown if clearing the TPM chip can mess with the BIOS HDD password support, but until someone tests it, it is best to play it safe.}}

{{HINT|A password-locked HDD can be made useful again by using a low-level utility capable of issuing the SECURE-ERASE command to it. You will lose all data, but at least the HDD will be usable again, as that also unlocks the HDD.}}

If there is a need to reset and clear the TPM chip, the IBM BIOS has a "Clear Security Chip" option that will work (as long as you did not issue one of the very few "permanently lock the TPM chip in a certain state for life" commands, so '''Do Not Do That!''').

That option is not readily accessible. To unhide it and reset the TPM chip, you have to:

=== Method 1 ===
#Power down the ThinkPad;
#Power up the ThinkPad, with the Fn key pressed (or CTRL in a ThinkCenter);
#When the BIOS screen shows up, release the Fn key;
#Press the required key to enter the BIOS configuration;
#Enter BIOS supervisor password if required;
#Go to the security menu, security chip submenu, and clear the TPM chip.

=== Method 2 ===

#Power down the ThinkPad;
#Power up the ThinkPad;
#Press the ThinkVantage/Access IBM button while the BIOS is still booting;
#Type in the supervisor password if the BIOS asks for it;
#Press ESC a number of times, which will cause the BIOS to switch to maintenance mode and display a number of text screens;
#Power down the ThinkPad as soon as it hits the boot loader of the Operating System (it doesn't matter which O.S.);
#Power on the ThinkPad;
#Enter the BIOS configuration screen (may require supervisor password);
#Go to the security menu, security chip submenu, and clear the TPM chip.

==Using the Embedded Security Subsystem==

=== TPM 1.1b basics ===

The TPM chip is a "secure" brokerer of data signatures and keys, as well as a slow but very good hardware RNG. It has some registers called PCRs that are used for trusted platform attestation. It can sign data using 2048-bit RSA keys. It is '''slow'''. It is not easy to use, either :-)

The current version of the TPM chips found on ThinkPads (TPM 1.1b) isn't secure at all against moderately sophisticated physical attacks, and it is also useless for DRM and other Treacherous Platform corporate ideas.

A Trusted Platform in a context involving a TPM means that the PCRs contains values that they are expected to, because the TPM will allow data that is "sealed" (as opposed to "bound") to it to be accessed ("unsealed") only when the PCRs match the PCRs at sealing time. The interesting magic is, therefore, in the process of updating the contents of the PCRs.

The PCRs start zeroed at TPM reset. As things load (BIOS, bootloader, OS, userspace), they are supposed to verify if the PCRs are at a state they can trust, and if so, to add the checksum of their own code, data, and configuration to the PCRs and load the next stage. Alternatively, they can skip the PCR test and just extend it if they don't care that they are running in an untrusted state.

PCRs cannot be set to a given value. The TPM only allows one to "extend" a PCR, which is an operation where the result is a SHA-1 hash that depends on the previous value of the PCR and on the data you give the TPM to extend the PCR with. It is non-trivial to get the PCR to a desired value based only on its previous contents and the desired target value.

It is obviously a total nightmare to update the system in a trusted platform scenario, as the contents of the PCRs starting from the update point will change. A changed PCR immediately makes any data that was sealed based on its old value impossible to access. This is one of the reasons why nobody is doing remote trusted platform assurance, except in very controlled scenarios right now. New versions of the specifications around the trusted platform support specifications (like TPM 1.2) are trying to address this problem.

Trusted Platform assurance with a TPM 1.1b isn't easy to do, but it is possible (and it is not in any way unbreakable!, but it is a lot better than nothing for many uses).

The ThinkPad BIOS measures the boot loader and stores the relevant data on PCR registers and the TPCA log, so if one adds a trusted boot loader to the system (like trusted-grub), one can load a trusted operating system and from there, trusted userspace applications, etc.

Note that LPC-bus tricks using modchips to trap and modify the data flow to the TPM chip can effectively bust the Trusted Platform assurance completely on any ThinkPads up to the T61/R61/X61. To avoid that, a TPM inside the northbridge is needed. Intel plans to add a TPM 1.2 to their chipsets in 2008, so it is likely that the T62/X62/R62 TPMs won't be as vulnerable to hardware hacks.

=== ThinkPad BIOS TPM basics ===

The TCG TCPA specification also defines PC BIOS behaviour and extensions to deal with the TPM chip and Trusted Platform requirements. The ThinkPad BIOS is compliant to the TCG PC Client specification v1.1 (and, in new ThinkPads, maybe v1.2).

This means that:
*The BIOS can be used to reset the TPM using physical presence (see above for the reset procedure);
*Physical presence is only available to the BIOS (unless you hack the BIOS or the hardware, obviously);
*The BIOS can be configured to log or not (which also means calculate PCRs) the checksum of some of the platform data. If you don't want the ESCD or NVRAM contents to interfere in PCR calculations, you need to disable their logging in the BIOS for example;
*The BIOS touches PCRs 0 to 7, but leaves PCRs 8 to 15 alone (zeroed);
*You can disable the TPM chip in the BIOS, and not worry about someone using it behind your back. But they will be able to know that there is a TPM in the system (the chip can still be found, and will report its version, manufacturer, and disabled state), unless you remove all the kernel TPM support, including tpm_bios;
*The BIOS might use the TPM, so watch out for trouble if you have HDD passwords enabled, etc;

==== PCR registers extended by the BIOS ====

{| width="100%" {{prettytable}}
| style="background:#ffdead;" width="10%" | '''PCR #'''
| style="background:#ffdead;" | '''Description (TCG PC client spec v1.1)'''
| style="background:#ffdead;" | '''Notes'''
|-
! colspan=3 style="text-align:center;background:#efefef;" |

==== T43 26xx BIOS 1.29 ====
|-
| 0
| CRTM, BIOS, and platform extensions
| The BIOS logs many BIOS POST PCR extensions, probably hardware and firmware-related
|-
| 1
| Platform configuration:
*BIOS ROM strings (BIOS version and checksum)
*NVRAM (Asset tag data)
*CMOS configuration (basic, always logged)
*CMOS configuration (extended)
*ESCD platform configuration data (like size of memory modules, etc)
*SMBIOS data (?)
|
*Useful when BIOS ROM logging is enabled, since one has to trust the BIOS and it is best to not let someone update it behind your back. Upgrading the BIOS invalidates data sealed to this PCR, though
*NVRAM logging is useful to seal data to a particular asset tag
|-
| 2
| Option ROM code
| Can be used to detect the addition/subtraction/upgrade of Option ROMs (extra BIOS code from third parties)
|-
| 3
| Option ROM configuration and data
| Not modified except for the event separator on my current T43 config
|-
| 4
| IPL Code (system bootstrap)
* BIOS password used to authorize booting (if any)
* Boot device used
* MBR/boot sector checksum (LILO, Grub stage 1, etc)
|
* The password hash itself of the BIOS user or supervisor password is used to extend this PCR
* When you reboot, if the box doesn't ask for a password, the PCR will have different contents (work around: go into BIOS and exit saving changes, so that you are asked the password again)
* Lets one seal data to a particular boot password and to the fact that the password was typed in the keyboard
* Takes into account the device used to boot, and the bootstrap code checksum
|-
| 5
| IPL Code configuration and data
| This PCR is reserved for the boot loader to extend with its configuration and whatever else it loads
*trusted-grub extends it with stage 1.5 and stage 2 checksums, grub.conf checksum, and kernel and initrd checksum
*Not modified by the BIOS itself, except for the event separator
|-
| 6
| State transitions and wake events
| Logs a WAKE EVENT 0 hash on power up and simple reset (same event)
|-
| 7
| Reserved
| Not modified except for the event separator. Reserved by the TCG for future use.
|-
| 8-15
| User PCRs
|
*Not modified by BIOS or bootstrap
*Still zeroed at end of Linux boot
*Can be used for whatever the user wants
|}

=== Using the TPM in Windows ===

Just install the full IBM Security solution, and let it use the TPM. What good it will do to increase the security of your data is unknown.

=== Using the TPM in Linux ===

This section is very incomplete, but here are some pointers to get you started:

*Compile a 2.6.23 or later kernel with the driver for the tpm chip in your ThinkPad model enabled;
**You need to enable CONFIG_SECURITY to get securityfs, and CONFIG_KEYS to use eCryptfs TPM support;
**You need to enable tpm_bios to access the TCPA log;
*Make sure to mount the securityfs filesystem on /sys/kernel/security to access tpm_bios data (the TCPA log);
*You should use dm-crypt to have an encrypted swap partition with an ephemeral key;
*The TCPA log can be found in the securityfs directory, and it might help you understand how the BIOS and boot loaders are using the PCRs. The first number for each event in the log is the number PCR register that was extended by that event;
*You need an up-to-date version of the TrouSerS software stack to use the TPM for anything other than reading the TPCA log;
*You need an up-to-date eCryptfs userspace (with TPM support compiled in) to use the TPM to store filesystem keys;
*Using the TPM as a PKCS11 token is possible, but I have no idea how safe it is, since that requires a null (well-known) SRK;
*trusted-grub can be used to play with the PCRs before Linux loads, and to checksum the Linux kernel and extend a PCR with that data;
*The PCRs can be read through sysfs, under the /sys/bus/platform/devices/tpm*/pcrs file for the TPM driver for your TPM chip;
*TrouSerS 0.3.1 tpm_getpubek seems not to work too well, it gets the PUBEK attributes wrong from the NSC TPM chip in a T43 (but the key data itself is correct). Compare to sys/bus/platform/devices/tpm*/pubek to check yours.

==Models featuring this Technology==
===IBM Embedded Security Chip===
*ThinkPad {{T23}}
===IBM Embedded Security Subsystem===
*ThinkPad {{A30p}}
*ThinkPad {{R31}}
*ThinkPad {{T23}}, {{T30}}
*ThinkPad {{X22}}, {{X23}}, {{X24}}

===IBM Embedded Security Subsystem 2.0===
*ThinkPad {{R32}}, {{R40}}, {{R50}}, {{R50p}}, {{R51}}, {{R51e}}, {{R52}}, {{R60}}, {{R61}}
*ThinkPad {{T40}}, {{T40p}}, {{T41}}, {{T41p}}, {{T42}}, {{T42p}}, {{T43}}, {{T43p}}, {{T60}}, {{T60p}}, {{T61}}, {{T61p}}
*ThinkPad {{X30}}, {{X31}}, {{X32}}, {{X40}}, {{X41}}, {{X41T}}, {{X60}}, {{X60s}}, {{X61s}}, {{X61_Tablet}}, {{X200}}
*ThinkPad {{Z60m}}, {{Z60t}}

[[Category:Glossary]]
[[Category:Trusted Computing]]

==TCPA/TCG clean models==
*all models produced before 2000
*all i Series models
*ThinkPad [[:Category:240X|240X]]
*ThinkPad [[:Category:A20m|A20m]], [[:Category:A20p|A20p]], [[:Category:A21e|A21e]], [[:Category:A21m|A21m]], [[:Category:A21p|A21p]], [[:Category:A22e|A22e]], [[:Category:A22m|A22m]], [[:Category:A22p|A22p]], [[:Category:A30|A30]]
*ThinkPad [[:Category:R50e|R50e]]
*ThinkPad [[:Category:T20|T20]], [[:Category:T21|T21]], [[:Category:T22|T22]]
*ThinkPad [[:Category:X20|X20]], [[:Category:X21|X21]], [[:Category:X22|X22]]
*ThinkPad [[:Category:TransNote|TransNote]]

==External Sources==
*[http://www.pc.ibm.com/us/think/thinkvantagetech/security.html IBMs ThinkVantage<sup>TM</sup> Technologies Embedded Security Subsystem page]
*[http://www.pc.ibm.com/presentations/us/thinkvantage/56/index.html?shortcut=ess& IBMs ThinkVantage<sup>TM</sup> Technologies Flash presentation - Embedded Security Subsystem]
*[https://www.trustedcomputinggroup.org/specs/PCClient/ TCG PC Client specifications]
*[http://www.research.ibm.com/gsal/tcpa/ IBM Research TCPA resources page]
*[http://www.prosec.rub.de/trusted_grub.html Trusted Grub]

Embedded Security Subsystem

2008-08-28T00:31:05Z

Ryanc: /* IBM Embedded Security Subsystem 2.0 */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;" | [[Image:ESS.jpg|IBM Embedded Security Subsystem]] __NOTOC__
|style="vertical-align:top" |
<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
=== The Embedded Security Subsystem ===
The Embedded Security Subsystem is a chip on the ThinkPad's mainboard that can take care of certain security related tasks conforming to the TCPA standard. It was first introduced among the T23 models and is now under the name "Embedded Security Subsystem 2.0". It is an integral part of most of the modern ThinkPads. The functions of the chip are fall into three main groups:
* Public key functions
* Trusted boot functions
* Initialization and management functions

The purpose of the Embedded Security Subsystem is to keep the user's sensitive data out of range from software based attacks (like viruses, Internet attacks etc.). One way the chip offers to achieve this is by providing storage for keys along with the necessary functions to handle them within itself, so that a for example a private key never has to leave the chip (can't be seen by any piece of software). Besides this, there are more complex topics covered by the functionality of the chip. If you want to find out more about it you can find good documents on the [http://www.research.ibm.com/gsal/tcpa/ IBM Research TCPA resources page].</div>
|}

{{NOTE|Some ThinkPads have the TPM chip integrated into the SuperIO chip, and in a not-so-distant future, the TPM will be integrated into the chipset. Don't let the picture fool you...}}

{{WARN|There's a bug in the latest release of the security chip software. You end up facing a security chip login, and you press Ctrl-alt-delete, and it just sits there. '''Do not''' download the latest patch (Dated 13/06/2006 v 7.00.0017.00) <BR>
Actually, they appear to have removed that patch.<BR>
Ring IBM support (in Australia 131426, 1, 2) and they'll talk you through doing a system restore.}}

==Trusted or Treacherous?==

TC - Trusted Computing - will be the biggest change of the information landscape since decades. Besides positive features like a more secure hardware storage for cryptographic keys, an analysis of the proposed TCG-standards shows some problematic properties. <br />
As ThinkPads of recent generations following the ThinkPad {{T23}} ([[Embedded Security Subsystem#Models featuring this Technology|see the complete list of models]]) are equipped with this disputed TCG-/TCPA-Technology, it can be interesting, which promises of the TCG are fulfilled inside your ThinkPad and which parts of the TCG-specifications still seem to be a privacy issue for every user of digital devices like a MP3-player or a ThinkPad - so please read [[TCPA/TCG - Trusted or Treacherous|this article]] for more details.

==Linux Support==
Two linux drivers are available, a [[tpm|classical one]] and a [[tpmdd|newer one]].
Coverage of functionality of the first is unknown so far, the second is part of a bigger project aiming to provide a usable security framework.

David Stafford (one of the developers of the tpm code at IBM) on March 10, 2005 sent me the most recent version of the tpm-kml code. With his permission, I quote his email:

"I am attaching our latest driver and library.
This version is in the process of kernel mailing list review, and
will hopefully be accepted into the official kernel. It works
much better across various 2.6 kernels. Note that this builds
three modules tpm, tpm_atmel, and tpm_nsc. You modprobe the
tpm_atmel (for all current shipping atmel based systems), or
tpm_nsc (for the coming national based systems).

Also note that there is a conflict with the snd-intel8x0
kernel module (they each try to grab the LPC bus). You can
either: load the tpm modules first (such as in initrd or
rc.sysinit, before sound), or recompile the snd-intel8x0, turning
off the MIDI and JOYSTICK support. The latest 2.6.11 version
of snd-intel8x0 also reportedly fixes things."

Compiling this library was easy. Compiling the driver on my 2.6.8-686 (debian testing) laptop failed. But the library works with the driver I compiled from the tpm-2.0 package IBM made available on its pages (see the links below).

Gijs

The T43 requires a patch posted to the LKML by Kylene Jo Hall: [http://marc.theaimsgroup.com/?l=linux-kernel&m=111884603309146&w=2 LKML posting]. An updated patch for linux 2.6.12 is available [http://shamrock.dyndns.org/~ln/linux/tpm_2.6.12.diff here].

The atmel driver comes with 2.6.12.
----
Now suported in 2.6.15.1 (and maybe others kernels under this number) in:

/device drivers/caracter devices/tpm devices

==Versions & Features==
=== Embedded Security Chip ===
IBM introduced it's TCPA/TCG features with some of the [[:Category:T23|T23]] models. The earlier of them didn't yet have the Embedded Security Subsystem, but a kind of pre 1.0 version called the Embedded Security Chip. This chip had the following capabilities:
*Data communications authentication and encryption
*Storage of encrypted passwords

=== Embedded Security Subsystem (1.0) ===
The original Embedded Security Subsystem (in IBM documents there is no use of the additive version-number 1.0) claims to be compliant with TCG specs, but apparently did not fully implement any specific TCG spec.

The Embedded Security Subsystem has the following features:
*hardware key storage
*multi-factor authentication
*local file encryption
*enhances VPN security

=== Embedded Security Subsystem 2.0 ===
The Embedded Security Subsystem 2.0 conforms to the TCG TPM 1.1b specification, with a TPM manufactured by either Atmel or National Semiconductor, and TCG TPM PC client 1.1 BIOS extensions.

The Embedded Security Subsystem 2.0 has the following features:
*hardware key storage
*multi-factor authentication
*local file encryption
*enhances VPN security
*TCG compliant

National Semiconductor TPMs are likely part of the Winbond SuperIO chip (e.g. in a {{T43}}).

{{NOTE|It is possible that second-generation T60s and the T61/X61/R61 have TPM chips conforming to TCG TPM 1.2. If you own one, please verify if that's true, and update this page}}

==Clearing/Reseting the Embedded Security Subsystem==

{{WARN|Be sure that there are no active HDD passwords, and that you have uninstalled any IBM/Lenovo security software that might want information stored or encrypted with the help of the TPM chip '''before''' you clear the chip. Any data that is encrypted using information inside the TPM chip will be useless after you clear the TPM chip. It is unknown if clearing the TPM chip can mess with the BIOS HDD password support, but until someone tests it, it is best to play it safe.}}

{{HINT|A password-locked HDD can be made useful again by using a low-level utility capable of issuing the SECURE-ERASE command to it. You will lose all data, but at least the HDD will be usable again, as that also unlocks the HDD.}}

If there is a need to reset and clear the TPM chip, the IBM BIOS has a "Clear Security Chip" option that will work (as long as you did not issue one of the very few "permanently lock the TPM chip in a certain state for life" commands, so '''Do Not Do That!''').

That option is not readily accessible. To unhide it and reset the TPM chip, you have to:

=== Method 1 ===
#Power down the ThinkPad;
#Power up the ThinkPad, with the Fn key pressed (or CTRL in a ThinkCenter);
#When the BIOS screen shows up, release the Fn key;
#Press the required key to enter the BIOS configuration;
#Enter BIOS supervisor password if required;
#Go to the security menu, security chip submenu, and clear the TPM chip.

=== Method 2 ===

#Power down the ThinkPad;
#Power up the ThinkPad;
#Press the ThinkVantage/Access IBM button while the BIOS is still booting;
#Type in the supervisor password if the BIOS asks for it;
#Press ESC a number of times, which will cause the BIOS to switch to maintenance mode and display a number of text screens;
#Power down the ThinkPad as soon as it hits the boot loader of the Operating System (it doesn't matter which O.S.);
#Power on the ThinkPad;
#Enter the BIOS configuration screen (may require supervisor password);
#Go to the security menu, security chip submenu, and clear the TPM chip.

==Using the Embedded Security Subsystem==

=== TPM 1.1b basics ===

The TPM chip is a "secure" brokerer of data signatures and keys, as well as a slow but very good hardware RNG. It has some registers called PCRs that are used for trusted platform attestation. It can sign data using 2048-bit RSA keys. It is '''slow'''. It is not easy to use, either :-)

The current version of the TPM chips found on ThinkPads (TPM 1.1b) isn't secure at all against moderately sophisticated physical attacks, and it is also useless for DRM and other Treacherous Platform corporate ideas.

A Trusted Platform in a context involving a TPM means that the PCRs contains values that they are expected to, because the TPM will allow data that is "sealed" (as opposed to "bound") to it to be accessed ("unsealed") only when the PCRs match the PCRs at sealing time. The interesting magic is, therefore, in the process of updating the contents of the PCRs.

The PCRs start zeroed at TPM reset. As things load (BIOS, bootloader, OS, userspace), they are supposed to verify if the PCRs are at a state they can trust, and if so, to add the checksum of their own code, data, and configuration to the PCRs and load the next stage. Alternatively, they can skip the PCR test and just extend it if they don't care that they are running in an untrusted state.

PCRs cannot be set to a given value. The TPM only allows one to "extend" a PCR, which is an operation where the result is a SHA-1 hash that depends on the previous value of the PCR and on the data you give the TPM to extend the PCR with. It is non-trivial to get the PCR to a desired value based only on its previous contents and the desired target value.

It is obviously a total nightmare to update the system in a trusted platform scenario, as the contents of the PCRs starting from the update point will change. A changed PCR immediately makes any data that was sealed based on its old value impossible to access. This is one of the reasons why nobody is doing remote trusted platform assurance, except in very controlled scenarios right now. New versions of the specifications around the trusted platform support specifications (like TPM 1.2) are trying to address this problem.

Trusted Platform assurance with a TPM 1.1b isn't easy to do, but it is possible (and it is not in any way unbreakable!, but it is a lot better than nothing for many uses).

The ThinkPad BIOS measures the boot loader and stores the relevant data on PCR registers and the TPCA log, so if one adds a trusted boot loader to the system (like trusted-grub), one can load a trusted operating system and from there, trusted userspace applications, etc.

Note that LPC-bus tricks using modchips to trap and modify the data flow to the TPM chip can effectively bust the Trusted Platform assurance completely on any ThinkPads up to the T61/R61/X61. To avoid that, a TPM inside the northbridge is needed. Intel plans to add a TPM 1.2 to their chipsets in 2008, so it is likely that the T62/X62/R62 TPMs won't be as vulnerable to hardware hacks.

=== ThinkPad BIOS TPM basics ===

The TCG TCPA specification also defines PC BIOS behaviour and extensions to deal with the TPM chip and Trusted Platform requirements. The ThinkPad BIOS is compliant to the TCG PC Client specification v1.1 (and, in new ThinkPads, maybe v1.2).

This means that:
*The BIOS can be used to reset the TPM using physical presence (see above for the reset procedure);
*Physical presence is only available to the BIOS (unless you hack the BIOS or the hardware, obviously);
*The BIOS can be configured to log or not (which also means calculate PCRs) the checksum of some of the platform data. If you don't want the ESCD or NVRAM contents to interfere in PCR calculations, you need to disable their logging in the BIOS for example;
*The BIOS touches PCRs 0 to 7, but leaves PCRs 8 to 15 alone (zeroed);
*You can disable the TPM chip in the BIOS, and not worry about someone using it behind your back. But they will be able to know that there is a TPM in the system (the chip can still be found, and will report its version, manufacturer, and disabled state), unless you remove all the kernel TPM support, including tpm_bios;
*The BIOS might use the TPM, so watch out for trouble if you have HDD passwords enabled, etc;

==== PCR registers extended by the BIOS ====

{| width="100%" {{prettytable}}
| style="background:#ffdead;" width="10%" | '''PCR #'''
| style="background:#ffdead;" | '''Description (TCG PC client spec v1.1)'''
| style="background:#ffdead;" | '''Notes'''
|-
! colspan=3 style="text-align:center;background:#efefef;" |

==== T43 26xx BIOS 1.29 ====
|-
| 0
| CRTM, BIOS, and platform extensions
| The BIOS logs many BIOS POST PCR extensions, probably hardware and firmware-related
|-
| 1
| Platform configuration:
*BIOS ROM strings (BIOS version and checksum)
*NVRAM (Asset tag data)
*CMOS configuration (basic, always logged)
*CMOS configuration (extended)
*ESCD platform configuration data (like size of memory modules, etc)
*SMBIOS data (?)
|
*Useful when BIOS ROM logging is enabled, since one has to trust the BIOS and it is best to not let someone update it behind your back. Upgrading the BIOS invalidates data sealed to this PCR, though
*NVRAM logging is useful to seal data to a particular asset tag
|-
| 2
| Option ROM code
| Can be used to detect the addition/subtraction/upgrade of Option ROMs (extra BIOS code from third parties)
|-
| 3
| Option ROM configuration and data
| Not modified except for the event separator on my current T43 config
|-
| 4
| IPL Code (system bootstrap)
* BIOS password used to authorize booting (if any)
* Boot device used
* MBR/boot sector checksum (LILO, Grub stage 1, etc)
|
* The password hash itself of the BIOS user or supervisor password is used to extend this PCR
* When you reboot, if the box doesn't ask for a password, the PCR will have different contents (work around: go into BIOS and exit saving changes, so that you are asked the password again)
* Lets one seal data to a particular boot password and to the fact that the password was typed in the keyboard
* Takes into account the device used to boot, and the bootstrap code checksum
|-
| 5
| IPL Code configuration and data
| This PCR is reserved for the boot loader to extend with its configuration and whatever else it loads
*trusted-grub extends it with stage 1.5 and stage 2 checksums, grub.conf checksum, and kernel and initrd checksum
*Not modified by the BIOS itself, except for the event separator
|-
| 6
| State transitions and wake events
| Logs a WAKE EVENT 0 hash on power up and simple reset (same event)
|-
| 7
| Reserved
| Not modified except for the event separator. Reserved by the TCG for future use.
|-
| 8-15
| User PCRs
|
*Not modified by BIOS or bootstrap
*Still zeroed at end of Linux boot
*Can be used for whatever the user wants
|}

=== Using the TPM in Windows ===

Just install the full IBM Security solution, and let it use the TPM. What good it will do to increase the security of your data is unknown.

=== Using the TPM in Linux ===

This section is very incomplete, but here are some pointers to get you started:

*Compile a 2.6.23 or later kernel with the driver for the tpm chip in your ThinkPad model enabled;
**You need to enable CONFIG_SECURITY to get securityfs, and CONFIG_KEYS to use eCryptfs TPM support;
**You need to enable tpm_bios to access the TCPA log;
*Make sure to mount the securityfs filesystem on /sys/kernel/security to access tpm_bios data (the TCPA log);
*You should use dm-crypt to have an encrypted swap partition with an ephemeral key;
*The TCPA log can be found in the securityfs directory, and it might help you understand how the BIOS and boot loaders are using the PCRs. The first number for each event in the log is the number PCR register that was extended by that event;
*You need an up-to-date version of the TrouSerS software stack to use the TPM for anything other than reading the TPCA log;
*You need an up-to-date eCryptfs userspace (with TPM support compiled in) to use the TPM to store filesystem keys;
*Using the TPM as a PKCS11 token is possible, but I have no idea how safe it is, since that requires a null (well-known) SRK;
*trusted-grub can be used to play with the PCRs before Linux loads, and to checksum the Linux kernel and extend a PCR with that data;
*The PCRs can be read through sysfs, under the /sys/bus/platform/devices/tpm*/pcrs file for the TPM driver for your TPM chip;
*TrouSerS 0.3.1 tpm_getpubek seems not to work too well, it gets the PUBEK attributes wrong from the NSC TPM chip in a T43 (but the key data itself is correct). Compare to sys/bus/platform/devices/tpm*/pubek to check yours.

==Models featuring this Technology==
===IBM Embedded Security Chip===
*ThinkPad {{T23}}
===IBM Embedded Security Subsystem===
*ThinkPad {{A30p}}
*ThinkPad {{R31}}
*ThinkPad {{T23}}, {{T30}}
*ThinkPad {{X22}}, {{X23}}, {{X24}}

===IBM Embedded Security Subsystem 2.0===
*ThinkPad {{R32}}, {{R40}}, {{R50}}, {{R50p}}, {{R51}}, {{R51e}}, {{R52}}, {{R60}}, {{R61}}
*ThinkPad {{T40}}, {{T40p}}, {{T41}}, {{T41p}}, {{T42}}, {{T42p}}, {{T43}}, {{T43p}}, {{T60}}, {{T60p}}, {{T61}}, {{T61p}}
*ThinkPad {{X30}}, {{X31}}, {{X32}}, {{X40}}, {{X41}}, {{X41T}}, {{X60}}, {{X60s}}, {{X61s}}, {{X61_Tablet}}
*ThinkPad {{Z60m}}, {{Z60t}}
*ThinkPad {{X200}}

[[Category:Glossary]]
[[Category:Trusted Computing]]

==TCPA/TCG clean models==
*all models produced before 2000
*all i Series models
*ThinkPad [[:Category:240X|240X]]
*ThinkPad [[:Category:A20m|A20m]], [[:Category:A20p|A20p]], [[:Category:A21e|A21e]], [[:Category:A21m|A21m]], [[:Category:A21p|A21p]], [[:Category:A22e|A22e]], [[:Category:A22m|A22m]], [[:Category:A22p|A22p]], [[:Category:A30|A30]]
*ThinkPad [[:Category:R50e|R50e]]
*ThinkPad [[:Category:T20|T20]], [[:Category:T21|T21]], [[:Category:T22|T22]]
*ThinkPad [[:Category:X20|X20]], [[:Category:X21|X21]], [[:Category:X22|X22]]
*ThinkPad [[:Category:TransNote|TransNote]]

==External Sources==
*[http://www.pc.ibm.com/us/think/thinkvantagetech/security.html IBMs ThinkVantage<sup>TM</sup> Technologies Embedded Security Subsystem page]
*[http://www.pc.ibm.com/presentations/us/thinkvantage/56/index.html?shortcut=ess& IBMs ThinkVantage<sup>TM</sup> Technologies Flash presentation - Embedded Security Subsystem]
*[https://www.trustedcomputinggroup.org/specs/PCClient/ TCG PC Client specifications]
*[http://www.research.ibm.com/gsal/tcpa/ IBM Research TCPA resources page]
*[http://www.prosec.rub.de/trusted_grub.html Trusted Grub]

Bluetooth Daughter Card (14 pins)

2008-08-28T00:30:33Z

Ryanc: /* ThinkPads Using This Device */

__NOTOC__
{| width="100%"
|style="vertical-align:top" |[[Image:Logo_bluetooth.jpg|Bluetooth Logo]]
|style="vertical-align:top" |
<div style="margin:0px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
=== ThinkPad Bluetooth with Enhanced Data Rate (BDC-2) ===
This is a USB Bluetooth Adapter that is installed in a [[CDC slot]] in the screen assembly.
=== Features ===
* Chipset: Broadcom
* Model: BCM2045B
* USB VID/PID: 0A5C:2110
</div>
|}

=== IBM Partnumbers ===
IBM FRU PN: 39T0497

=== Linux Driver ===

The Bluetooth adapter uses the '''hci_usb''' driver {{kernelconf|CONFIG_BT_HCIUSB||||||}}.

One can enable Bluetooth by pressing {{key|Fn}}{{key|F5}}. If this doesn't work, you can load the [[ibm-acpi|ibm_acpi]] or [[ibm-acpi|thinkpad_acpi]] kernel module and run the following command with root privileges:

{{cmdroot|echo "enable" > /proc/acpi/ibm/bluetooth}}

When Bluetooth is enabled, the Bluetooth-logo LED will light up and executing {{cmdroot|lsusb}} will show an entry mentioning "Broadcom".

On recent ThinkPads the Wireless killswitch disables both WiFi and Bluetooth (verified on a ThinkPad Z60m, Z61t, T60, T61 and X61).

=== Set Fn + F5 as hotkey to enable/disable Bluetooth ===
If the {{key|Fn}}{{key|F5}} combo doesn't work for you out-of-box, you can easily use Linux ACPI subsystem to enable and disable Bluetooh. You only need to create two small files (shown below). Note that you need to have <code>acpid</code> and <code>thinkpad_acpi</code> installed and properly working. The following scripts were tested on openSUSE 10.3.
==== ACPI action script ====
<pre># cat /etc/acpi/actions/bluetooth
#!/bin/bash
# Bluetooth enable/disable script

/etc/init.d/bluetooth status | grep -q running

if [ "$?" -ne 0 ]; then
/etc/init.d/bluetooth start > /dev/null
echo enabled > /proc/acpi/ibm/bluetooth
echo "Bluetooth enabled"
else
/etc/init.d/bluetooth stop > /dev/null
echo disabled > /proc/acpi/ibm/bluetooth
echo "Bluetooth disabled"
fi</pre>
This script, when executed, detects the current state of Bluetooth subsystem and changes it to the opposite state.
==== ACPI event handler ====
<pre># cat /etc/acpi/events/bluetooth
event=ibm/hotkey HKEY 00000080 00001005
action=/etc/acpi/actions/bluetooth</pre>
<code>acpid</code>, once detects Fn + F5 keypress, runs the given script which disables or enables Bluetooth (and changes state of indication LED).

=== See Also ===
* [[How_to_setup_Bluetooth|How to Setup Bluetooth]]

=== ThinkPads Using This Device ===
* {{Z60m}}, {{Z60t}}, {{Z61t}}
* {{R60}}, {{R61}}
* {{T60}}, {{T60p}}, {{T61}}, {{T61p}}
* {{X200}}

=== External Sources ===
*[http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-51427 IBM's page about configuring Bluetooth under Linux]
*[http://www.broadcom.com/products/Bluetooth/Bluetooth-RF-Silicon-and-Software-Solutions/BCM2045 Broadcom BCM2045 Product]
*[http://blogs.ebay.com.hk/lingqi-tech/archive/2007/12 Compare CDC slot types and CDC Bluetooth Cards for various ThinkPad Models]

[[Category:Components]]

Integrated Fingerprint Reader

2008-08-28T00:30:05Z

Ryanc: /* Models featuring this Technology */

{| width="100%"
|style="vertical-align:top;padding-right:20px;width:10px;" | [[Image:fingerprintreader.jpg|IBM Integrated Fingerprint Reader]] __NOTOC__
|style="vertical-align:top" |
<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
===Integrated Fingerprint Reader===
IBM released a second generation of T42 models in Autumn 2004 featuring Intel Pentium M 765 processors and an integrated fingerprint reader.

The fingerprint reader is produced by a company called UPEK, which specializes in the manufacture of fingerprint readers. It is integrated as an USB device, and does all the matching in hardware, making it rather easy to use. Furthermore, IBM states that there's an interface with the [[Embedded Security Subsystem]]. UPEK now sells the fingerprint reader as a USB peripheral bundled with the same underlying software for accessing password-protected online accounts and Windows: [http://www.upek.com/solutions/eikon Eikon Digital Privacy Manager]

However: The fingerprint reader is an INSECURE device and gives a false sense of security! There has been quite a bit of research by a hacker named Starbug, a member of the Chaos Computer Club, Berlin, Germany. He outlined in two very good talks how to forge each and every available fingerprint sensor available at the cost of a few euros, using materials from your local hardware store, a digicam and a laser printer! Here's some links:
* [http://www.ccc.de/updates/2007/umsonst-im-supermarkt?language=en Fingerprint recognition in supermarkets]
* [ftp://ftp.ccc.de/pub/video/Fingerabdruck_Hack/fingerabdruck.mpg?language=en Video tutorial for forging fingerprints]
Remember, using fingerprints for authentication is much similar to having a password which is written on anything you touch.

==Open Source==

There is a new GPL driver at http://thinkfinger.sourceforge.net; see the [[How to enable the fingerprint reader with ThinkFinger]] for detailed instructions. This is the recommended option as it integrates more seamlessly with PAM and doesn't produce a tacky graphical prompt.

{{HINT|If you've followed the instructions and "tf-tool --verify" works, but nothing else does, make sure that the "uinput" module is loaded.}}

Newer variants of the {{R61}} require a different driver. This newer fingerprint reader [http://www.reactivated.net/fprint/wiki/Upeksonly device] sits on the USB bus with USB ID 147e:2016. An open source driver has been developed by [http://www.reactivated.net/fprint/wiki/Main_Page the fprint project]. Installation instructions can be found at [http://knowledge76.com/index.php/Fingerprint_Reader_Installation System76].

==Binary Only==
A closed source driver from the vendor has been released. It interfaces to the hardware as a user-space USB driver through {{path|/proc/bus/usb|}} and provides a BioAPI 1.10 device, which can then be interfaced to pam for authentication by user programs. The driver can be downloaded from http://www.upek.com/support/dl_linux_bsp.asp; see the [[How to enable the fingerprint reader|corresponding HOWTO]] for detailed instructions. It however tends to be less stable than the above opensource driver.

==Related Links==
* [http://www.trustedreviews.com/article.aspx?page=1643&head=36 Review from TrustedReviews of the fingerprint scanner]
* [http://biomark.org.ru/en/ A (Russian) project that provides support for a (different model) of fingerprint scanner] (also a USB device, though)
* [http://www.upek.com/support/pdf/UPEK_flyer_TCS3_TCD4.pdf TouchStrip TCS3/TCD4 spec sheet]
* [http://www.qrivy.net/~michael/blua/ A branch of the BioAPI reference implementation]
* [http://www.reactivated.net/fprint/wiki/Main_Page fprint project]

==Models featuring this Technology==
*ThinkPad {{R52}}, {{R60}}, {{R61}}
*ThinkPad {{T42}}, {{T42p}}, {{T43}}, {{T43p}}, {{T60}}, {{T60p}}, {{T61}}, {{T61p}}
*ThinkPad {{X41}}, {{X41T}}, {{X60}}, {{X60s}}, {{X61s}}, {{X61_Tablet}}
*ThinkPad {{Z60m}}, {{Z60t}}, {{Z61m}}, {{Z61p}}, {{Z61t}}
*ThinkPad {{X200}}

[[Category:Glossary]]

Intel Wifi Link 5100 (AGN)

2008-08-28T00:28:39Z

Ryanc:

[http://lkml.org/lkml/2008/8/13/435 Support for Linux appears in 2.6.27]

==== Models ====
* {{X200}}

Intel Wifi Link 5300 (AGN)

2008-08-28T00:28:04Z

Ryanc:

[http://lkml.org/lkml/2008/8/13/435 Support for Linux appears in 2.6.27]

==== Models ====
* {{X200}}

Intel Wifi Link 5300 (AGN)

2008-08-28T00:27:40Z

Ryanc: â†Created page with '[http://lkml.org/lkml/2008/8/13/435 Support for Linux appears in 2.6.27]'

[http://lkml.org/lkml/2008/8/13/435 Support for Linux appears in 2.6.27]

Intel Wifi Link 5100 (AGN)

2008-08-28T00:27:04Z

Ryanc: â†Created page with '[http://lkml.org/lkml/2008/8/13/435 Support for Linux appears in 2.6.27]'

[http://lkml.org/lkml/2008/8/13/435 Support for Linux appears in 2.6.27]

MiniPCI Express slot

2008-08-28T00:24:59Z

Ryanc:

{| width="100%"
<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
A MiniPCI Express slot is a version of the PCI-Express x1 slot for Notebooks

</div>
|}
__NOTOC__

=== MiniPCI Express Adapters ===
* [[Intel PRO/Wireless 3945ABG Mini-PCI Express Adapter]]
* [[Intel PRO/Wireless 4965AGN Mini-PCI Express Adapter]]
* [[Intel Wifi Link 5100 (AGN)]]
* [[Intel Wifi Link 5300 (AGN)]]
* [[ThinkPad 11a/b/g/n Wireless LAN Mini Express Adapter]]
* [[ThinkPad 11a/b/g Wireless LAN Mini Express Adapter]]
* [[ThinkPad 11b/g Wireless LAN Mini-PCI Express Adapter III]]
* [[Verizon 1xEV-DO WWAN]]

=== (In)Compatibility ===
Though the slot is MiniPCIe in form factor, it has been crippled to only accept devices with PCI-ID's contained in a BIOS whitelist consisting of the above list of devices (likely not exhaustive and varying depending on the particular system) with the additional requirement that they '''must carry the Lenovo brand name and consequently cost twice as much'''. If an unauthorized card is plugged in it gives a <tt>1802</tt> error on initial boot up before it even touches the operating system. (see [[Problem with unauthorized MiniPCI network card]], [http://forum.notebookreview.com/showthread.php?t=69445 1802 with MiniPCIe on t60],[http://forums.lenovo.com/lnv/board/message?board.id=T_Series_Thinkpads&message.id=274 same]). The workarounds on the first link concerning MiniPCI devices may or may not be directly applicable to the MiniPCIe slot. Anyone who has added non-Lenovo components to this slot either successfully or unsuccessfully is encouraged to provide any relevant details here.

=== Linux support ===
MiniPCI Express adapters are handled by the Linux PCI subsystem.

=== Models featuring this Technology ===
* ThinkPad {{T60}}, {{T60p}}, {{R61}}, {{T61}}, {{T61p}}
* ThinkPad {{X60}}, {{X60s}}, {{X61}}, {{X61s}}, {{Z61m}}
* ThinkPad {{Z Series}}
* ThinkPad {{X200}}

[[Category:Components]]
=== External sources ===
* Lenovo [ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/accessories_guide_us_can_dec2007.pdf accessories guide].

Template:X200

2008-08-28T00:22:16Z

Ryanc: â†Created page with 'X200Category:X200'

[[:Category:X200|X200]][[Category:X200]]

Ethernet Controllers

2008-08-28T00:17:44Z

Ryanc: /* Intel Gigabit (10/100/1000) */

== Internal Ethernet controller ==

A variety of [[Ethernet]] controllers is integrated into almost all models starting with the introduction of the A, T and X series.

The Ethernet controller is located on either a MiniPCI card, Communications Daughter Card (CDC), or integrated on the systemboard.

=== 3COM Fast Ethernet (10/100) ===
MiniPCI cards featuring this chip:
*[[3Com 10/100 Ethernet Mini-PCI Adapter with 56K Modem]]

=== Intel Fast Ethernet (10/100) ===
CDC and MiniPCI cards featuring this chip:
*[[Ethernet Daughter Card (EDC)]]
*[[Intel 10/100 Ethernet Mini-PCI Adapter with 56K Modem]]
*[[Intel PRO/100 SP Mobile Combo Adapter]]
*[[Mini-PCI Ethernet card]]
*[[Xircom 10/100 EtherJet Mini PCI Adapter with 56K Modem]]

In addition, this chip is integrated into select systemboards of the following machines:<br>
'''Intel 82550GY'''
* {{R30}}
'''Intel 82558'''
* [[SelectaBase PC Card Enabler with Advanced EtherJet]]
* [[ThinkPad Port Replicator with Advanced EtherJet]]
'''Intel 82562ET'''
* {{R31}}, {{R32}}
* {{T30}}
* {{X30}}
'''Intel 82562EZ'''
* {{R40}}, {{R50e}}, {{R50}}, {{R51}}
* {{T40}}
* {{X31}}

Driver: [[e100]] (The 'e100' driver is the suggested driver, but '[[eepro100]]' should also work.)

=== Intel Gigabit (10/100/1000) ===
Chipset: Intel PRO/1000 MT Mobile Ethernet<br />
Driver: [[e1000]]

This chip is integrated into select systemboards of the following machines:<br>
'''Intel 82540EP'''
* {{R50}}, {{R50p}}, {{R51}}
* {{T40}}, {{T40p}}, {{T41}}, {{T41p}}, {{T42}}, {{T42p}}
* {{X31}}, {{X32}}
'''Intel 82541GI'''
* {{R51}}
* {{X40}}
'''Intel 82573L''' (PCI-Express)
* {{T60}}, {{T60p}}
* {{X60}}, {{X60s}}
** Note: known to freeze the whole system on Ubuntu 8.10 when used with the e1000 driver, while e1000e driver does not recognize the adapter - see https://bugs.launchpad.net/ubuntu/+bug/226906/
'''Intel 82566MM''' (PCI-Express) (w/ [[Intel Active Management Technology (AMT)]])
* {{T61}}, {{T61p}}, {{X61}}, {{X61s}}, {{X61_Tablet}}
'''Intel 82567LM''' (PCI-Express) (w/ [[Intel Active Management Technology (AMT)]])
* {{X200}}
* Driver: [[e1000e]]
Note: DO NOT(!!!) use the "irqpoll" boot parameter. This causes the network card to lose it's irq, and makes any stability of the network connection impossible.
Note: There is a [[Problem with e1000: Open issue with latency|known issue]] with the e1000, t60/t60p and the 2.6.17 kernel. It is unconfirmed if this issue effects other configurations.<br>
Note: This chip supports Auto-MDIX, meaning you will never need a crossover ethernet cable.<br>
Note: The first signs of explicit support for this chip in 2.6 kernels is with 2.6.12-rc2.<br>
Note: Red Hat Enterprise Linux 3.0 (2.4 kernel based) begins 82573L support with Update 7.<br>
Note: Some users report issues: [[Problem_with_e1000:_EEPROM_Checksum_Is_Not_Valid]]. This issue stands behind the symptom, that the intel controller 82573L will only work, if a network cable is attached at boot time (seen at X60 running with ubuntu).<br>
Note: Some users have reported [http://forum.thinkpads.com/viewtopic.php?p=201279&sid=787564d7cf9de5d7d76b0cb312a98c61 latency problems] with e1000 driver. It seems, that [http://agenda.clustermonkey.net/index.php/Tuning_Intel_e1000_NICs switching off Interupt Throttle Rate (ITR)] helps. <br>
Note: [http://support.intel.com/support/network/sb/CS-009209.htm Additional configuration options from Intel]<br/>
Note: Another possibility is to use "RxIntDelay=5".

For Gentoo users - compile e1000 as a kernel module and add 'options e1000 InterruptThrottleRate=0,0' to /etc/modules.d/e1000

I had serious performance problems on Ubuntu Edgy (ca. 400 kb/s File transfer rate).
I compiled version e1000-7.3.20 from http://sourceforge.net/projects/e1000/ and this solved my problem.
All other hints above did not improve the file transfer performance (they did improve the ping latency) for me.

=== Broadcom Fast Ethernet (10/100) ===
Driver: [[tg3]] or [[bcm5700]]

This chip is integrated into select systemboards of the following machines:<br>
'''Broadcom BCM5901'''
* {{G40}}, {{G41}}
* {{R40e}}
'''Broadcom BCM5751F'''
* {{R51e}}

=== Broadcom Gigabit (10/100/1000) ===
Driver: [[tg3]] or [[bcm5700]]

This chip is integrated into select systemboards of the following machines:

'''Broadcom BCM5752M'''
* {{Z61e}}

'''Broadcom BCM5751M'''
* {{R52}}, {{R60}}
* {{G41}}
* {{T43}}, {{T43p}}
* {{X41}}, {{X41T}}
* {{Z60m}}, {{Z60t}}
* {{Z61m}}, {{Z61p}}

Note: There are some problems with the driver since kernel 2.6.17 (at least on a Z61p, Z61m). After an ifdown && ifup it doesn't work anymore. A possible workaround is to build the tg3-driver as a module and reload it when this problem occours. (Adding ''pre-up modprobe tg3'' and ''post-down rmmod tg3'' to the corresponding section in /etc/network/interfaces works fine.) Rebooting the machine would also be possible.
This is fixed in kernel 2.6.19-rc5.

The T43 with a stock Linux 2.6.18.1 kernel does not have any problems.

[[Category:Components]]

Category:X200

2008-08-28T00:14:16Z

Ryanc: Expanded features list, linked to resources and reviews

{| width="100%"
|style="vertical-align:top" |
=== ThinkPad X200 ===
This page gives an overview of all ThinkPad X200 related topics.

<div style="margin: 0; margin-right:10px; border: 1px solid #dfdfdf; padding: 0em 1em 1em 1em; background-color:#F8F8FF; align:right;">
==== Standard Features ====
* One of the following processors:
** [[Intel Core 2 Duo]] P8400, 2.26Ghz, 3MB L2, 1066Mhz FSB
** [[Intel Core 2 Duo]] P8600, 2.40Ghz, 3MB L2, 1066Mhz FSB
* [[Intel Graphics Media Accelerator 4700 MHD]] onboard graphics
** 12" CCFL with 1280×800 (WXGA, 200 nit)
* Support for up to 5GB DDR3-RAM [[PC3-8500]]
** As of 27 Aug 2008, 4GB option is most available and '''only''' if you select upgrade to Windows Vista Business 64
* One of the following hard drives:
** 80,160,250 GB SATA 2.5" 5400/7200RPM
** 320 GB 5400RPM
** 200 GB Sata 2.5" 7200RPM with [[Full Disk Encryption (FDE)]]
** 64 GB SATA 1.8" SSD
* ThinkPad X200 Ultrabase
** DVD-ROM, CD-RW/DVD-ROM, DVD Burner, Blu-ray
* One of the following expansion slots:
** 5-1 Media card Reader with Modem
** 3-1 Media card Reader without Modem
* [[Ethernet Controllers#Intel Gigabit (10/100/1000)|Intel Gigabit Ethernet Controller]]
* [[MiniPCI Express slot]] 1 with one of the following:
** [[ThinkPad 11b/g Wireless LAN Mini-PCI Express Adapter III]]
** [[Intel Wifi Link 5100 (AGN)]] (supported in Linux as of kernel 2.6.27)
** [[Intel Wifi Link 5300 (AGN)]] (supported in Linux as of kernel 2.6.27)
* [[MiniPCI Express slot]] 2 with one of the following:
** Integrated WWAN with GPS
** Integrated Ultra Wide Band (UWB) for AT&T
** Integrated Ultra Wide Band (UWB) for Verizon
** WiMAX (late 2008)
** [[Intel® Turbo Memory hard drive cache]] 2GB
* Optional Features
** Integrated camera
** Integrated digital microphone
** Security cable slot
** [[Integrated Fingerprint Reader]]
* [[ThinkPad_Bluetooth_with_Enhanced_Data_Rate_(BDC-2)|Bluetooth]]
* [[Embedded Security Subsystem|IBM Embedded Security Subsystem 2.0]]
* [[Active Protection System|IBM Active Protection System]]
* TrackPoint '''only'''
* One of the following batteries
** 4-cell battery, up to 3.3 hr, 1.34kg
** 6-cell battery, up to 6.5 hr, 1.47kg
** 9-cell battery, up to 9.8 hr, 1.63kg (protrudes out back 22.8cm/.9in)
</div>

==== Resources ====
* [http://shop.lenovo.com/ISS_Static/merchandising/US/PDFs/x200_datasheet.pdf X200 Technical Specifications (pdf)]

==== Reviews ====
* [http://www.notebookreview.com/default.asp?newsID=4497 Notebookreview.com] 2008-07-15
* [http://www.laptopmag.com/review/laptops/lenovo-thinkpad-x200.aspx Laptopmag.com] 2007-07-14
* [http://reviews.cnet.com/laptops/lenovo-thinkpad-x200/4505-3121_7-33184078.html Cnet.com] 2008-08-14

[[Category:X Series]]

Ethernet Controllers

2008-08-27T23:57:41Z

Ryanc: /* Intel Gigabit (10/100/1000) */

== Internal Ethernet controller ==

A variety of [[Ethernet]] controllers is integrated into almost all models starting with the introduction of the A, T and X series.

The Ethernet controller is located on either a MiniPCI card, Communications Daughter Card (CDC), or integrated on the systemboard.

=== 3COM Fast Ethernet (10/100) ===
MiniPCI cards featuring this chip:
*[[3Com 10/100 Ethernet Mini-PCI Adapter with 56K Modem]]

=== Intel Fast Ethernet (10/100) ===
CDC and MiniPCI cards featuring this chip:
*[[Ethernet Daughter Card (EDC)]]
*[[Intel 10/100 Ethernet Mini-PCI Adapter with 56K Modem]]
*[[Intel PRO/100 SP Mobile Combo Adapter]]
*[[Mini-PCI Ethernet card]]
*[[Xircom 10/100 EtherJet Mini PCI Adapter with 56K Modem]]

In addition, this chip is integrated into select systemboards of the following machines:<br>
'''Intel 82550GY'''
* {{R30}}
'''Intel 82558'''
* [[SelectaBase PC Card Enabler with Advanced EtherJet]]
* [[ThinkPad Port Replicator with Advanced EtherJet]]
'''Intel 82562ET'''
* {{R31}}, {{R32}}
* {{T30}}
* {{X30}}
'''Intel 82562EZ'''
* {{R40}}, {{R50e}}, {{R50}}, {{R51}}
* {{T40}}
* {{X31}}

Driver: [[e100]] (The 'e100' driver is the suggested driver, but '[[eepro100]]' should also work.)

=== Intel Gigabit (10/100/1000) ===
Chipset: Intel PRO/1000 MT Mobile Ethernet<br />
Driver: [[e1000]]

This chip is integrated into select systemboards of the following machines:<br>
'''Intel 82540EP'''
* {{R50}}, {{R50p}}, {{R51}}
* {{T40}}, {{T40p}}, {{T41}}, {{T41p}}, {{T42}}, {{T42p}}
* {{X31}}, {{X32}}
'''Intel 82541GI'''
* {{R51}}
* {{X40}}
'''Intel 82573L''' (PCI-Express)
* {{T60}}, {{T60p}}
* {{X60}}, {{X60s}}
** Note: known to freeze the whole system on Ubuntu 8.10 when used with the e1000 driver, while e1000e driver does not recognize the adapter - see https://bugs.launchpad.net/ubuntu/+bug/226906/
'''Intel 82566MM''' (PCI-Express) (w/ [[Intel Active Management Technology (AMT)]])
* {{T61}}, {{T61p}}, {{X61}}, {{X61s}}, {{X61_Tablet}}
'''Intel 82567LM''' (PCI-Express) (w/ [[Intel Active management Technology (AMT)]])
* {{X200}}
* Driver: [[e1000e]]
Note: DO NOT(!!!) use the "irqpoll" boot parameter. This causes the network card to lose it's irq, and makes any stability of the network connection impossible.
Note: There is a [[Problem with e1000: Open issue with latency|known issue]] with the e1000, t60/t60p and the 2.6.17 kernel. It is unconfirmed if this issue effects other configurations.<br>
Note: This chip supports Auto-MDIX, meaning you will never need a crossover ethernet cable.<br>
Note: The first signs of explicit support for this chip in 2.6 kernels is with 2.6.12-rc2.<br>
Note: Red Hat Enterprise Linux 3.0 (2.4 kernel based) begins 82573L support with Update 7.<br>
Note: Some users report issues: [[Problem_with_e1000:_EEPROM_Checksum_Is_Not_Valid]]. This issue stands behind the symptom, that the intel controller 82573L will only work, if a network cable is attached at boot time (seen at X60 running with ubuntu).<br>
Note: Some users have reported [http://forum.thinkpads.com/viewtopic.php?p=201279&sid=787564d7cf9de5d7d76b0cb312a98c61 latency problems] with e1000 driver. It seems, that [http://agenda.clustermonkey.net/index.php/Tuning_Intel_e1000_NICs switching off Interupt Throttle Rate (ITR)] helps. <br>
Note: [http://support.intel.com/support/network/sb/CS-009209.htm Additional configuration options from Intel]<br/>
Note: Another possibility is to use "RxIntDelay=5".

For Gentoo users - compile e1000 as a kernel module and add 'options e1000 InterruptThrottleRate=0,0' to /etc/modules.d/e1000

I had serious performance problems on Ubuntu Edgy (ca. 400 kb/s File transfer rate).
I compiled version e1000-7.3.20 from http://sourceforge.net/projects/e1000/ and this solved my problem.
All other hints above did not improve the file transfer performance (they did improve the ping latency) for me.

=== Broadcom Fast Ethernet (10/100) ===
Driver: [[tg3]] or [[bcm5700]]

This chip is integrated into select systemboards of the following machines:<br>
'''Broadcom BCM5901'''
* {{G40}}, {{G41}}
* {{R40e}}
'''Broadcom BCM5751F'''
* {{R51e}}

=== Broadcom Gigabit (10/100/1000) ===
Driver: [[tg3]] or [[bcm5700]]

This chip is integrated into select systemboards of the following machines:

'''Broadcom BCM5752M'''
* {{Z61e}}

'''Broadcom BCM5751M'''
* {{R52}}, {{R60}}
* {{G41}}
* {{T43}}, {{T43p}}
* {{X41}}, {{X41T}}
* {{Z60m}}, {{Z60t}}
* {{Z61m}}, {{Z61p}}

Note: There are some problems with the driver since kernel 2.6.17 (at least on a Z61p, Z61m). After an ifdown && ifup it doesn't work anymore. A possible workaround is to build the tg3-driver as a module and reload it when this problem occours. (Adding ''pre-up modprobe tg3'' and ''post-down rmmod tg3'' to the corresponding section in /etc/network/interfaces works fine.) Rebooting the machine would also be possible.
This is fixed in kernel 2.6.19-rc5.

The T43 with a stock Linux 2.6.18.1 kernel does not have any problems.

[[Category:Components]]

Intel® Turbo Memory hard drive cache

2008-08-27T23:56:52Z

Ryanc:

__NOTOC__
{| width="100%"
| style="vertical-align:top" |
Intel Turbo Memory is an add-on memory for read and write caching of the hard-drive. (Previously dubbed as Robson.)

== Features ==
* Non-volatile Flash Memory (512MB or 1GB NAND-flash)
* Improve system responsiveness
* Speed-up boot time
* Reduce power consumption
| style="vertical-align:top" | [[Image:Intel_turbomemory.jpg|Turbo Memory card]]

(picture credits intel)
|}

== Support Operating system ==
* Windows Vista only (via Vista ReadyBoost and Vista ReadyDrive)

== Supported Laptops ==
{{T61}}, {{T61p}}, {{X61_Tablet}}, {{X200}} (only Turbo Memory module or WWAN module can exists at the same time)

== External links ==
* [http://www.intel.com/design/flash/nand/turbomemory/index.htm Official website]

Intel® Turbo Memory hard drive cache

2008-08-27T23:56:40Z

Ryanc:

__NOTOC__
{| width="100%"
| style="vertical-align:top" |
Intel Turbo Memory is an add-on memory for read and write caching of the hard-drive. (Previously dubbed as Robson.)

== Features ==
* Non-volatile Flash Memory (512MB or 1GB NAND-flash)
* Improve system responsiveness
* Speed-up boot time
* Reduce power consumption
| style="vertical-align:top" | [[Image:Intel_turbomemory.jpg|Turbo Memory card]]

(picture credits intel)
|}

== Support Operating system ==
* Windows Vista only (via Vista ReadyBoost and Vista ReadyDrive)

== Supported Laptops ==
{{T61}}, {{T61p}}, {{X61_Tablet}}, {{X200} (only Turbo Memory module or WWAN module can exists at the same time)

== External links ==
* [http://www.intel.com/design/flash/nand/turbomemory/index.htm Official website]

Ethernet Controllers

2008-08-27T23:29:09Z

Ryanc: /* Intel Gigabit (10/100/1000) */

== Internal Ethernet controller ==

A variety of [[Ethernet]] controllers is integrated into almost all models starting with the introduction of the A, T and X series.

The Ethernet controller is located on either a MiniPCI card, Communications Daughter Card (CDC), or integrated on the systemboard.

=== 3COM Fast Ethernet (10/100) ===
MiniPCI cards featuring this chip:
*[[3Com 10/100 Ethernet Mini-PCI Adapter with 56K Modem]]

=== Intel Fast Ethernet (10/100) ===
CDC and MiniPCI cards featuring this chip:
*[[Ethernet Daughter Card (EDC)]]
*[[Intel 10/100 Ethernet Mini-PCI Adapter with 56K Modem]]
*[[Intel PRO/100 SP Mobile Combo Adapter]]
*[[Mini-PCI Ethernet card]]
*[[Xircom 10/100 EtherJet Mini PCI Adapter with 56K Modem]]

In addition, this chip is integrated into select systemboards of the following machines:<br>
'''Intel 82550GY'''
* {{R30}}
'''Intel 82558'''
* [[SelectaBase PC Card Enabler with Advanced EtherJet]]
* [[ThinkPad Port Replicator with Advanced EtherJet]]
'''Intel 82562ET'''
* {{R31}}, {{R32}}
* {{T30}}
* {{X30}}
'''Intel 82562EZ'''
* {{R40}}, {{R50e}}, {{R50}}, {{R51}}
* {{T40}}
* {{X31}}

Driver: [[e100]] (The 'e100' driver is the suggested driver, but '[[eepro100]]' should also work.)

=== Intel Gigabit (10/100/1000) ===
Chipset: Intel PRO/1000 MT Mobile Ethernet<br />
Driver: [[e1000]]

This chip is integrated into select systemboards of the following machines:<br>
'''Intel 82540EP'''
* {{R50}}, {{R50p}}, {{R51}}
* {{T40}}, {{T40p}}, {{T41}}, {{T41p}}, {{T42}}, {{T42p}}
* {{X31}}, {{X32}}
'''Intel 82541GI'''
* {{R51}}
* {{X40}}
'''Intel 82573L''' (PCI-Express)
* {{T60}}, {{T60p}}
* {{X60}}, {{X60s}}
** Note: known to freeze the whole system on Ubuntu 8.10 when used with the e1000 driver, while e1000e driver does not recognize the adapter - see https://bugs.launchpad.net/ubuntu/+bug/226906/
'''Intel 82566MM''' (PCI-Express) (w/ [[Intel Active Management Technology (AMT)]])
* {{T61}}, {{T61p}}, {{X61}}, {{X61s}}, {{X61_Tablet}}
'''Intel 82567LM''' (PCI-Express) (w/ [[Intel Active management Technology (AMT)]])
* {{X300}}
* Driver: [[e1000e]]
Note: DO NOT(!!!) use the "irqpoll" boot parameter. This causes the network card to lose it's irq, and makes any stability of the network connection impossible.
Note: There is a [[Problem with e1000: Open issue with latency|known issue]] with the e1000, t60/t60p and the 2.6.17 kernel. It is unconfirmed if this issue effects other configurations.<br>
Note: This chip supports Auto-MDIX, meaning you will never need a crossover ethernet cable.<br>
Note: The first signs of explicit support for this chip in 2.6 kernels is with 2.6.12-rc2.<br>
Note: Red Hat Enterprise Linux 3.0 (2.4 kernel based) begins 82573L support with Update 7.<br>
Note: Some users report issues: [[Problem_with_e1000:_EEPROM_Checksum_Is_Not_Valid]]. This issue stands behind the symptom, that the intel controller 82573L will only work, if a network cable is attached at boot time (seen at X60 running with ubuntu).<br>
Note: Some users have reported [http://forum.thinkpads.com/viewtopic.php?p=201279&sid=787564d7cf9de5d7d76b0cb312a98c61 latency problems] with e1000 driver. It seems, that [http://agenda.clustermonkey.net/index.php/Tuning_Intel_e1000_NICs switching off Interupt Throttle Rate (ITR)] helps. <br>
Note: [http://support.intel.com/support/network/sb/CS-009209.htm Additional configuration options from Intel]<br/>
Note: Another possibility is to use "RxIntDelay=5".

For Gentoo users - compile e1000 as a kernel module and add 'options e1000 InterruptThrottleRate=0,0' to /etc/modules.d/e1000

I had serious performance problems on Ubuntu Edgy (ca. 400 kb/s File transfer rate).
I compiled version e1000-7.3.20 from http://sourceforge.net/projects/e1000/ and this solved my problem.
All other hints above did not improve the file transfer performance (they did improve the ping latency) for me.

=== Broadcom Fast Ethernet (10/100) ===
Driver: [[tg3]] or [[bcm5700]]

This chip is integrated into select systemboards of the following machines:<br>
'''Broadcom BCM5901'''
* {{G40}}, {{G41}}
* {{R40e}}
'''Broadcom BCM5751F'''
* {{R51e}}

=== Broadcom Gigabit (10/100/1000) ===
Driver: [[tg3]] or [[bcm5700]]

This chip is integrated into select systemboards of the following machines:

'''Broadcom BCM5752M'''
* {{Z61e}}

'''Broadcom BCM5751M'''
* {{R52}}, {{R60}}
* {{G41}}
* {{T43}}, {{T43p}}
* {{X41}}, {{X41T}}
* {{Z60m}}, {{Z60t}}
* {{Z61m}}, {{Z61p}}

Note: There are some problems with the driver since kernel 2.6.17 (at least on a Z61p, Z61m). After an ifdown && ifup it doesn't work anymore. A possible workaround is to build the tg3-driver as a module and reload it when this problem occours. (Adding ''pre-up modprobe tg3'' and ''post-down rmmod tg3'' to the corresponding section in /etc/network/interfaces works fine.) Rebooting the machine would also be possible.
This is fixed in kernel 2.6.19-rc5.

The T43 with a stock Linux 2.6.18.1 kernel does not have any problems.

[[Category:Components]]