X-Series ThinkPads are niiiiice ¶

I have been using a ThinkPad X230t for the past 3 years, and, although the tablet is a little bulky, it has been everything I need in a work laptop – matte screen, physical buttons for all the things, an Ethernet port – it’s basically not an unbelievably stupid laptop design (which is the bar now, evidently). The X220 I purchased for work is even better – it’s slightly smaller (since it’s not also a Wacom tablet), plus the X220 has a nice keyboard – which – holy shit! – remember when anyone actually cared about laptop keyboards‽

I am become hacker, destroyer of laptops ¶

One of the other reasons for buying the X220 is that I’ve heard-tell (A.K.A, did a quick DDG search) that it supports Coreboot (although, sadly, not Libreboot, yet). The actual incantations for flashing the ROM on the X220 are spread over a few sources, with some sizable gaps in process.

I spent the past 2 days pretty lost, flailing in the dark, booting my freshly flashed laptop to a momentary flicker of the green power-light, no fans, nothing, sighing, and compiling again. Now I stand victorious, Debian stable (8.6 as of November 2016) is booting from SeaBIOS.

I kept a lot of notes on the process. Hopefully, these notes save someone some frustration, or make this process a tiny bit more approachable.

Caveat Emptor – I’m terrible at hardware stuff and writing, so follow these steps at your own peril!

Things you need ¶

• Lonovo ThinkPad X220
• USB to TTY Serial Cable
• Raspberry Pi 3 Model B
• Pomona SOIC8 5250 Test Clip
• 8x Female Jumper Wire
• An HDMI monitor and external keyboard (possibly, you may be able to figure out how to do this without one)
• Another computer that will act as your Raspberry Pi terminal via the USB to TTY serial cable (is what I did anyway)

ThinkPad X220 Disassembly ¶

1. Remove Keyboard and palmrest (follow Lonovo’s Guide)
   • Power down and remove battery
   • I removed the keyboard and palm rest in 2 separate steps.
   • Flip over and remove the 7 screws holding the keyboard and palmrest in place (they all have a picture of a square with 3 buttons [trackpad, I guess] near them).
   • WARNING – 2 of these screws are different sizes than the other 5! The ones closest to the front-edge of the laptop are shorter, keep them seperate.
   • Locations Diagram:

       Bottom of the ThinkPad -- 'X' marks screws to be removed
      +-----------------------------------------------------------+
      |   xxxxxxxxxxxx Battery xxxxxxxxxxxxxxxxxxxxxxxxx          |
      |   xxxxxxxxxxxxx Area xxxxxxxxxxxxxxxxxxxxxxxxxxx          |
      |                                                           |
      |                                                           |
      |                                                           |
      |              +----X----------------+                      |
      |              |                     |                      |
      |              |      Memory         |                      |
      |              |       Door          |                      |
      |   X          |        X            |             X        |
      |      X       +---------------------+                      |
      |                  X               X                        |
      +-----------------------------------------------------------+

   • Flip it over, push the keyboard back, pull up the tabs near the palmrest.
   • Rest the removed keyboard on the palmrest and remove ribbon cable from the motherboard.
   • Flip palmrest up, and click the ribbon cable holding it in place, remove it.
   • Lift tape on the left side of motherboard covering the chip you’re looking for.
   • The BIOS chip you are looking for is right there – the left-front of the motherboard if the screen is facing you.

Setup Your Pi as a Flasher ¶

Now that you have access to the BIOS chip, you should setup your Raspberry Pi, and attach it to the Pomona 5250 clip via the SPI pins. Unfortunately, you do seem to need a monitor with HDMI to setup the Pi (someone better at Raspberry Pi things may know better).

After the initial setup I was able to switch to using a serial cable interface.

GIANT HUGE WARNING OF DOOM: Hook your Pomona clip to your motherboard ONLY WITH THE BATTERY REMOVED, THE X220 UNPLUGGED, AAAANNDDD THE RASPBERRY PI OFF!!!! You could probably fry this chip. I don’t actually know, but I was paranoid about it throughout the process. Power on the Raspberry Pi only when you’re certain the Pomona clip is secure.

1. Download the Raspbian Lite torrent

2. Unzip the rasbian zip file and copy to an sd card

   dd bs=4M if=rasbian-lite.img of=/dev/<partition of sd card>

3. Hook up your Raspberry Pi to a monitor and boot

4. Change password using passwd (default user/pass: pi/raspberry)

5. Setup wifi by editing /etc/wpa_supplicant/wpa_supplicant.conf

   network={
       ssid="YOUR_SSID"
       psk="YOUR_PASSWORD"
   }

6. Edit /boot/config.txt

   dtparam=spi=on
   enable_uart=1

7. Now you can reboot and hook to a serial cable:

   Serial cable hookup diagram:

      Edge of pi (furthest from you)
    L    PWR       GND  TXD  RXD
    E      |         |    |    |
    F +----v---------v----v----v-------------------------------------------------------------------------------+
    T |    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    |
      |    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    |
    E +--------------------------------------------------------------------------------------------------------+
    D
    G
    E
      Body of Pi (closest to you)

8. Install all the pre-req software working mostly from github wiki page Hardware Flashing with Raspberry Pi

   sudo apt-get update && sudo apt-get dist-upgrade && sudo reboot
   sudo apt-get update && sudo apt-get install libftdi1 libftdi-dev libusb-dev libpci-dev subversion
   sudo apt-get install build-essential pciutils usbutils libpci-dev libusb-dev libftdi1 libftdi-dev zlib1g-dev subversion
   svn co svn://flashrom.org/flashrom/trunk flashrom
   cd flashrom
   make
   sudo make install

   Add the SPI kernal modules to /etc/modules so they persist between boots.

   sudo modprobe spi_bcm2835
   sudo modprobe spidev

9. Power down the Pi, Hook your Pi to your Pomona clip, then hook the Pomona clip to the motherboard, and power back up.

   

   X220 BIOS Chip pinout

    Screen (furthest from you)
                __
     MOSI  5 --|  |-- 4  GND
      CLK  6 --|  |-- 3  N/C
      N/C  7 --|  |-- 2  MISO
      VCC  8 --|__|-- 1  CS
   
      Edge (closest to you)

   PI Pinout

   WARNING!!! This is the pinout for the RASPBERRY PI 3 MODEL B V1.2 it has 40 pins rather than 26

      Edge of pi (furthest from you)
    L                                                             CS
    E                                                             |
    F +--------------------------------------------------------------------------------------------------------+
    T |    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    |
      |    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    |
    E +--------------------------------------------^----^----^----^---------------------------------------^----+
    D                                              |    |    |    |                                       |
    G                                             3.3V  MOSI MISO |                                      GND
    E                                           (VCC)            CLK
      Body of Pi (closest to you)

10. See if flashrom can detect your chipset (if you see No EEPROM/flash device found. double check your connections and the pins for your pi – I realized I had my pins setup as if I were on the 26-GPIO pin Raspberry Pi rather than the 40-GPIO pin model 3)

    NOTE: 2018-04-06

    One person emailed to indicate that the flashrom commands below required setting an spispeed, i.e., sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=512

    pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0
    flashrom v0.9.9-r1954 on Linux 4.4.26-v7+ (armv7l)
    flashrom is free software, get the source code at https://flashrom.org
    
    Calibrating delay loop... OK.
    Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) on linux_spi.
    No operations were specified.

11. Read your flashchip and verify that the md5sums match. If the md5sums of your reads don’t match repeat steps 9 and 10 until they do. If they never do, check your wiring with a multimeter (I had to do this at one point).

    pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash01.bin
    pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash02.bin
    pi@raspberrypi:~$ md5sum flash01.bin flash02.bin

12. Download coreboot on the Pi. Compile and use ifdtool to extract all the needed bits to all the right places in the coreboot blobs directory.

    git clone http://review.coreboot.org/coreboot.git ~/coreboot
    cd ~/coreboot
    git submodule update --init --recursive
    cd ~/coreboot/util/ifdtool
    make
    sudo make install
    cd ~
    ifdtool -x ~/flash01.bin
    mkdir -p ~/coreboot/3rdparty/blobs/mainboard/lenovo/x220
    cd ~/coreboot/3rdparty/blobs/mainboard/lenovo/x220
    mv ~/flashregion_0_flashdescriptor.bin descriptor.bin
    mv ~/flashregion_2_intel_me.bin me.bin
    mv ~/flashregion_3_gbe.bin gbe.bin

    NOTE: 2017-06-15

    Thomas Maulbeck emailed me and mentioned that git submodule update --init --recursive did not populate the 3rdparty/blobs directory. It seems that .gitmodules for coreboot has several urls that look in the parent directory for bare git repositories that don’t exist in the setup I’ve described in this post.

    Maulbeck was able to work around compilation errors by cloning 3rdparty/blobs directly:

    cd ~/coreboot/3rdparty
    git clone http://review.coreboot.org/p/blobs.git

    If compilation fails with some mention of a missing 3rdparty/blobs/cpu/intel/model_206ax/microcode.bin this may be the root cause.

13. Build coreboot on the Pi following the wiki instructions

    • configure via (note – this is completely cargo-culted bullshit and YMMV…a lot) make nconfig

    general
        - [*] Compress ramstage with LZMA
        - [*] Include coreboot .config file into the ROM image
        - [*] Allow use of binary-only repository
    mainboard
        -  Mainboard vendor (Lenovo)
        -  Mainboard model (ThinkPad X220)
        -  ROM chip size (8192 KB (8 MB))
        -  (0x100000) Size of CBFS filesystem in ROM
    chipset
        - [*] Enable VMX for virtualization
        -  Include CPU microcode in CBFS (Generate from tree)
        -  Flash ROM locking on S3 resume (Don't lock ROM sections on S3 resume)
        - [*] Add Intel descriptor.bin file
          (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/descriptor.bin) Path and filename of the descriptor.bin file
        - [*] Add Intel ME/TXE firmware
          (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/me.bin) Path to management engine firmware
        - [*] Add gigabit ethernet firmware
          (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/gbe.bin) Path to gigabit ethernet firmware
    devices
        - [*] Use native graphics initialization
    display
        - (nothing checked)
    generic drivers
        - [*] Support Intel PCI-e WiFi adapters
        - [*] PS/2 keyboard init
    console
        - [*] Squelch AP CPUs from early console.
          [*] Show POST codes on the debug console
    system tables
        - [*] Generate SMBIOS tables
    payload
        - Add a payload (SeaBIOS)
        - SeaBIOS version (master)
        - (3000) PS/2 keyboard controller initialization timeout (milliseconds)
        - [*] Harware init during option ROM execution
        - [*] Include generated option rom that implements legacy VGA BIOS compatibility
        - [*] Use LZMA compression for payloads
    debugging
        - (nothing checked)

    NOTE: 2018-04-06

    One person emailed to mention that make nconfig may require a number of dependencies, see the coreboot wiki for a complete list. As of this writing that list reads: apt-get install git build-essential gnat flex bison libncurses5-dev wget zlib1g-dev

    • Compile coreboot!

    make crossgcc-i386 CPUS=4
    make iasl
    make

    EDIT – 2016-11-27 Andreas Sinninger pointed out I was missing the path to the Intel ME/TXE firmware – corrected.

14. FINALLY! Flash your new coreboot.rom to your rom chip: {.bash} pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash01.bin pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash02.bin pi@raspberrypi:~$ md5sum flash01.bin flash02.bin # if these don't match, stop, turn off the pi, fiddle with the Pomona clip, repeat this step pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -w ~/coreboot/build/coreboot.rom

If your laptop boots up to a SeaBIOS screen at this point: you win! If not, don’t despair, you can flash flash01.bin to go back to your old BIOS, or, better yet, keep compiling until it works.

Resources ¶

These are some general resources without which my X220 would be a pathetic pile of smashed up silicon by now.

• ThinkPad X220 on the coreboot wiki
• GitHub Coreboot-ThinkPad wiki, Hardware Flashing with Raspberry Pi
• noq2 - Corebooting ThinkPad x230
• Eric Holzback - Coreboot on the Lonovo X230