lm-sensors/README.thinkpad

****  WARNING: IBM Thinkpad users should not install lm_sensors!  ****

The eeprom of some IBM Thinkpads have been corrupted after installing
lm_sensors.

In our releases through 2.6.4, sensors-detect (our userspace detection script)
corrupts the Atmel 24RF08 eeprom. We have verified this in testing.
After the eeprom is corrupted, the checksum verification in the BIOS
will fail and the Thinkpad will not boot.

The 24RF08 is an 8K eeprom appearing at addresses 0x54 - 0x57 with
an additional "access protection page" at address 0x5c.
This is an unusual eeprom that contains a RFID (Radio Frequency ID)
port for wireless access, and elaborate access protection mechanisms.
The 24RF08 gets confused (presumably due to a state machine flaw) by
the 'quick write 0' (*) probes our package uses for detection.
This behavior is in violation of the I2C specification. This corruption
mechanism has never been reported to us on any other eeprom,
Atmel or otherwise.

We have made several changes in release 2.6.5 to minimize the
chance of corruption. Later evolutions were made and the current state is:

1) Sensors-detect accesses VPD information in the BIOS to identify IBM
   systems. If it finds the VPD structure (which is IBM-proprietary),
   sensors-detect will print a message and exit. This is a temporary
   additional measure, which will be removed as soon as the other
   measures have proven to be efficient.

2) The probing command (quick write 0) has been replaced by a different
   command (read byte) for addresses where eeproms are known to live.
   This should prevent corruption of 24RF08 eeproms in any system,
   IBM or not. A similar change was made to i2cdetect as well, although
   no corruption was ever reported using this tool.

3) The i2c-piix4 module (the bus driver that is used for Intel PIIX4-based
   systems, including IBM Thinkpads) now accesses DMI information
   in the BIOS to identify the system manufacturer. If the system
   manufacturer is IBM, i2c-piix4 will print a message and exit.
   As the 24RF08 is on the PIIX4 SMBus, this prevents access to
   the 24RF08, even if sensors-detect was not used.

4) The sequence of probes in the eeprom module (when loaded with
   checksum=1) has been changed so that 24RF08 eeproms will
   not be corrupted. This *should* prevent corruption of 24RF08
   eeproms in non-IBM systems.
   We do not have any reports of this corruption mechanism in releases
   2.6.4 or earlier but have verified that it can happen.
   The ddcmon driver was changed in the same way, just in case.

Even with these changes, we still DO NOT RECOMMEND INSTALLING
lm_sensors 2.6.5 or later on IBM Thinkpads, because:

1) While these changes will dramatically reduce the chance of 24RF08
   corruption, these changes have not been heavily tested.

2) lm_sensors won't run on most IBM systems because of these changes.

3) Most IBM Thinkpads contain a proprietary Embedded Controller which
   is used to access sensors. This controller is not on the SMBus,
   and IBM will not release the programming interface to the
   controller. So lm_sensors isn't useful on these Thinkpads anyway.

You may want to try ACPI instead, it should let you get some information
about temperatures and fan status.

As described above, our 2.6.5 release "blacklisted" all IBM systems.
For a moment, we have been planning to refine the system detection
so that only those models containing 24RF08's are blacklisted. After that,
we planned to use a different approach: a "white list" of known-to-be-safe
systems. In both cases, it would require continuous updates of a machines
list. This would have been slow and inefficient.

The latest idea is to stop using the dangerous command for EEPROM
addresses. That way, risks of corruption are reduced to zero. This was
already done for user-space tools, as mentioned above. Once this will
have been tested and we are sure that there are no drawbacks, we'll
do the same on the kernel side in Linux 2.6. The change won't occur in
Linux 2.4 however, because it implies changes to both i2c modules and
lm_sensors modules. It is possible to use mismatching versions of
these modules, and when doing so, the fix would become more dangerous
than helpful.

We do not have any reports of 24RF08 eeproms on non-IBM systems.
If there are any such systems with 24RF08 eeproms, these changes will
reduce the chances of corruption. However, there are
theoretical scenarios (involving multiple bus masters,
SMP systems, or simultaneous bus access) in which 24RF08's could
still be corrupted. If you know of any non-IBM systems which contain
these eeproms, please contact us.


Thanks to IBM, the Linux Thinkpad Mailing List, and Joe in Australia
for their assistance on this issue.

For more information, see:

The Linux Thinkpad Mailing List
http://www.bm-soft.com/~bm/tp_mailing.html

Joe in Australia's Thinkpad Password Recovery Site
http://www.ja.axxs.net/unlock/

Atmel 24RF08 Datasheet
http://www.atmel.com/dyn/products/product_card.asp?part_id=2370

Site in the US that sells replacement AT24RF08 chips for all models
http://www.pwcrack.com/


(*) 'Write Quick 0' is not an actual write and should never generate
     a write operation to an eeprom location.