[ mate und technik ]

Das sublab - ein Hackerspace in Leipzig

Statusdisplay


Taifun: Online  Offline
Trieste: Online  Offline

Livestream


Fundsachen

22. bis 25. Mai: CryptoCon



Mitglied werden

coreboot logo

n00bie guide for getting coreboot to a x201{i/s/t}

why would I want this?

  • prevent badBIOS
  • free open source BIOS / EFI implementation
  • fast (faster than Lenovo BIOS)
  • no PCI ID whitelist restrictions (WiFi / WWAN)
  • you can boot even with SATA-password set (for example to change/delete it with hdparm)
  • hotswap harddrive (didn't test, but should work)
  • it's cool.

okay, show me how!

preliminary actions

first you should update your existing BIOS. This is important as you cannot update your ECP version afterwards. Linux users can use the ISO files provided by Lenovo and do some nice trick described here

It is also advisable to save the output of dmidecode somewhere, as you need specific BIOS versions strings to get thinkpad_acpi to work.

next buy or build a SPI flasher and get a SOIC8 clip for mounting the chip correctly.

the ugly part

you have to dump the existing BIOS using flashrom and an external SPI flasher. here's the pinout:

  ====  front (display) =====
3.3V     N/C      CLK      MOSI
 |        |        |        |
 |        |        |        |
CS       MISO     N/C      ground
  ====  back (touchpad) =====

buspirate attached Now it should look similar to this:

You probably have to adjust your contacts quite often for it to work, so don't give up ;) try to keep the cables as short as possible.

now read your chip at least twice with

flashrom -p <yourprogrammer> -r flash.bin
flashrom -p <yourprogrammer> -r flash2.bin
diff flash.bin flash2.bin

If the files differ you have read errors -> bad: check your cables && try again.

easy part

  • extract descriptor / intel ME
dd if=flash.bin of=coreboot/3rdparty/mainboard/lenovo/x201/descriptor.bin \
   count=12288 bs=1M iflag=count_bytes
dd if=flash.bin of=coreboot/3rdparty/mainboard/lenovo/x201/me.bin \
   skip=12288 count=5230592 bs=1M iflag=count_bytes,skip_bytes
  • extract vgabios.bin from BIOS (I used PhoenixTool in a WinBitch VM for this, as the included bios extractor from coreboot didn't work for me)
  • hint SWIM uploaded it somewhere in the internets
  • use your prior version number for local version string (e.g "6QET70WW (1.40)")
  • at least UNCHECK fake IFD and specify paths to descriptor / ME
  • select SeaBIOS as payload
  • DO NOT FORGET vgabios.bin
  • compile coreboot (you'll need gcc-multilib and your python bin should point to python2, else create a venv)
  • flash resulting ROM image with
 
flashrom -c $Chip -w coreboot/build/coreboot.rom -p internal:laptop=force_I_want_a_brick 

credits to Vladimir Serbinenko (coreboot developer) for answering to all my questions and fixing minor problems.

additional pics

Chip location SOIC mount SPI flasher

additional links

Coreboot wiki page for x201 BIOS extract