My work laptop is terrible. About a year and a half ago, when I started my current gig, I received an Asus Zenbook that has been the bane of my existence ever since. First, it is impossible to work outside on this shiny monstrosity: all you see is your own dumb face squinting back at you, slightly obscured by very noticeable fingerprints from its mirror-like screen. Why are there fingerprints on the screen? Because, oh yeah, it’s a terrible touchscreen for no real reason. While the keyboard is serviceable, it is far from being a joy to use. There are no physical mouse buttons which, on a Linux install, means I’m forever flailing, trying to get middle-click paste to work (LPT: I setup an xdotool shortcut to paste – doesn’t work in Emacs though…). The Asus has also succumb to the Apple-esque use of dongles to replace all necessary ports (like Ethernet, FFS).

The final straw for this ridiculous machine was, for a reason that is beyond me, UEFI occasionally loses track of the boot drives and (although you can still see(!) the .efi file on disk via the UEFI interface) it won’t let you add it as a boot drive until you’ve sweated enough and/or there is a sufficiently powerful cosmic ray to flip the bits necessary to allow you to continue your life. This problem pretty much killed my productivity at my last offsite – as a result I decided to drop $500 and get a refurb ThinkPad X220 with more RAM and a bigger SSD than the ($1800) Zenbook.

X-Series ThinkPads are niiiiice

I have been using a ThinkPad X230t for the past 3 years, and, although the tablet is a little bulky, it has been everything I need in a work laptop – matte screen, physical buttons for all the things, an Ethernet port – it’s basically not an unbelievably stupid laptop design (which is the bar now, evidently). The X220 I purchased for work is even better – it’s slightly smaller (since it’s not also a Wacom tablet), plus the X220 has a nice keyboard – which – holy shit! – remember when anyone actually cared about laptop keyboards‽

I am become hacker, destroyer of laptops

One of the other reasons for buying the X220 is that I’ve heard-tell (A.K.A, did a quick DDG search) that it supports Coreboot (although, sadly, not Libreboot, yet). The actual incantations for flashing the ROM on the X220 are spread over a few sources, with some sizable gaps in process.

I spent the past 2 days pretty lost, flailing in the dark, booting my freshly flashed laptop to a momentary flicker of the green power-light, no fans, nothing, sighing, and compiling again. Now I stand victorious, Debian stable (8.6 as of November 2016) is booting from SeaBIOS.

I kept a lot of notes on the process. Hopefully, these notes save someone some frustration, or make this process a tiny bit more approachable.

Caveat Emptor – I’m terrible at hardware stuff and writing, so follow these steps at your own peril!

Things you need

What the whole flashing setup looked like for me X230 -> USB-to-TTY -> Raspberry Pi -> Pomona Clip -> X220
What the whole flashing setup looked like for me X230 -> USB-to-TTY -> Raspberry Pi -> Pomona Clip -> X220

ThinkPad X220 Disassembly

  1. Remove Keyboard and palmrest (follow Lonovo’s Guide)
    • Power down and remove battery
    • I removed the keyboard and palm rest in 2 separate steps.
    • Flip over and remove the 7 screws holding the keyboard and palmrest in place (they all have a picture of a square with 3 buttons [trackpad, I guess] near them).
    • WARNING – 2 of these screws are different sizes than the other 5! The ones closest to the front-edge of the laptop are shorter, keep them seperate.
    • Locations Diagram:
        Bottom of the ThinkPad -- 'X' marks screws to be removed
       +-----------------------------------------------------------+
       |   xxxxxxxxxxxx Battery xxxxxxxxxxxxxxxxxxxxxxxxx          |
       |   xxxxxxxxxxxxx Area xxxxxxxxxxxxxxxxxxxxxxxxxxx          |
       |                                                           |
       |                                                           |
       |                                                           |
       |              +----X----------------+                      |
       |              |                     |                      |
       |              |      Memory         |                      |
       |              |       Door          |                      |
       |   X          |        X            |             X        |
       |      X       +---------------------+                      |
       |                  X               X                        |
       +-----------------------------------------------------------+
    • Flip it over, push the keyboard back, pull up the tabs near the palmrest.
    • Rest the removed keyboard on the palmrest and remove ribbon cable from the motherboard.
    • Flip palmrest up, and click the ribbon cable holding it in place, remove it.
    • Lift tape on the left side of motherboard covering the chip you’re looking for.
    • The BIOS chip you are looking for is right there – the left-front of the motherboard if the screen is facing you.
Pomona 5250 attached to BIOS clip on ThinkPad X220
Pomona 5250 attached to BIOS clip on ThinkPad X220

Setup Your Pi as a Flasher

Now that you have access to the BIOS chip, you should setup your Raspberry Pi, and attach it to the Pomona 5250 clip via the SPI pins. Unfortunately, you do seem to need a monitor with HDMI to setup the Pi (someone better at Raspberry Pi things may know better).

After the initial setup I was able to switch to using a serial cable interface.

GIANT HUGE WARNING OF DOOM: Hook your Pomona clip to your motherboard ONLY WITH THE BATTERY REMOVED, THE X220 UNPLUGGED, AAAANNDDD THE RASPBERRY PI OFF!!!! You could probably fry this chip. I don’t actually know, but I was paranoid about it throughout the process. Power on the Raspberry Pi only when you’re certain the Pomona clip is secure.

  1. Download the Raspbian Lite torrent
  2. Unzip the rasbian zip file and copy to an sd card

    dd bs=4M if=rasbian-lite.img of=/dev/<partition of sd card>
  3. Hook up your Raspberry Pi to a monitor and boot

  4. Change password using passwd (default user/pass: pi/raspberry)

  5. Setup wifi by editing /etc/wpa_supplicant/wpa_supplicant.conf

    network={
        ssid="YOUR_SSID"
        psk="YOUR_PASSWORD"
    }
  6. Edit /boot/config.txt

    dtparam=spi=on
    enable_uart=1
  7. Now you can reboot and hook to a serial cable:

    Serial cable hookup diagram:

       Edge of pi (furthest from you)
     L    PWR       GND  TXD  RXD
     E      |         |    |    |
     F +----v---------v----v----v-------------------------------------------------------------------------------+
     T |    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    |
       |    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    |
     E +--------------------------------------------------------------------------------------------------------+
     D
     G
     E
       Body of Pi (closest to you)
  8. Install all the pre-req software working mostly from github wiki page Hardware Flashing with Raspberry Pi

    sudo apt-get update && sudo apt-get dist-upgrade && sudo reboot
    sudo apt-get update && sudo apt-get install libftdi1 libftdi-dev libusb-dev libpci-dev subversion
    sudo apt-get install build-essential pciutils usbutils libpci-dev libusb-dev libftdi1 libftdi-dev zlib1g-dev subversion
    svn co svn://flashrom.org/flashrom/trunk flashrom
    cd flashrom
    make
    sudo make install

    Add the SPI kernal modules to /etc/modules so they persist between boots.

    sudo modprobe spi_bcm2835
    sudo modprobe spidev
  9. Power down the Pi, Hook your Pi to your Pomona clip, then hook the Pomona clip to the motherboard, and power back up.

    Raspberry Pi 3 attached to ThinkPad X220 Pomona Clip
    Raspberry Pi 3 attached to ThinkPad X220 Pomona Clip

    X220 BIOS Chip pinout

     Screen (furthest from you)
                 __
      MOSI  5 --|  |-- 4  GND
       CLK  6 --|  |-- 3  N/C
       N/C  7 --|  |-- 2  MISO
       VCC  8 --|__|-- 1  CS
    
       Edge (closest to you)

    PI Pinout

    WARNING!!! This is the pinout for the RASPBERRY PI 3 MODEL B V1.2 it has 40 pins rather than 26

       Edge of pi (furthest from you)
     L                                                             CS
     E                                                             |
     F +--------------------------------------------------------------------------------------------------------+
     T |    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    |
       |    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    x    |
     E +--------------------------------------------^----^----^----^---------------------------------------^----+
     D                                              |    |    |    |                                       |
     G                                             3.3V  MOSI MISO |                                      GND
     E                                           (VCC)            CLK
       Body of Pi (closest to you)
  10. See if flashrom can detect your chipset (if you see No EEPROM/flash device found. double check your connections and the pins for your pi – I realized I had my pins setup as if I were on the 26-GPIO pin Raspberry Pi rather than the 40-GPIO pin model 3)

    pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0
    flashrom v0.9.9-r1954 on Linux 4.4.26-v7+ (armv7l)
    flashrom is free software, get the source code at https://flashrom.org
    
    Calibrating delay loop... OK.
    Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) on linux_spi.
    No operations were specified.
  11. Read your flashchip and verify that the md5sums match. If the md5sums of your reads don’t match repeat steps 9 and 10 until they do. If they never do, check your wiring with a multimeter (I had to do this at one point).

    pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash01.bin
    pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash02.bin
    pi@raspberrypi:~$ md5sum flash01.bin flash02.bin
  12. Download coreboot on the Pi. Compile and use ifdtool to extract all the needed bits to all the right places in the coreboot blobs directory.

    git clone http://review.coreboot.org/coreboot.git ~/coreboot
    cd ~/coreboot
    git submodule update --init --recursive
    cd ~/coreboot/util/ifdtool
    make
    sudo make install
    cd ~
    ifdtool -x ~/flash01.bin
    mkdir -p ~/coreboot/3rdparty/blobs/mainboard/lenovo/x220
    cd ~/coreboot/3rdparty/blobs/mainboard/lenovo/x220
    mv ~/flashregion_0_flashdescriptor.bin descriptor.bin
    mv ~/flashregion_2_intel_me.bin me.bin
    mv ~/flashregion_3_gbe.bin gbe.bin
  13. Build coreboot on the Pi following the wiki instructions

    • configure via (note – this is completely cargo-culted bullshit and YMMV…a lot) make nconfig
    general
        - [*] Compress ramstage with LZMA
        - [*] Include coreboot .config file into the ROM image
        - [*] Allow use of binary-only repository
    mainboard
        -  Mainboard vendor (Lenovo)
        -  Mainboard model (ThinkPad X220)
        -  ROM chip size (8192 KB (8 MB))
        -  (0x100000) Size of CBFS filesystem in ROM
    chipset
        - [*] Enable VMX for virtualization
        -  Include CPU microcode in CBFS (Generate from tree)
        -  Flash ROM locking on S3 resume (Don't lock ROM sections on S3 resume)
        - [*] Add Intel descriptor.bin file
          (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/descriptor.bin) Path and filename of the descriptor.bin file
        - [*] Add Intel ME/TXE firmware
          (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/me.bin) Path to management engine firmware
        - [*] Add gigabit ethernet firmware
          (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/gbe.bin) Path to gigabit ethernet firmware
    devices
        - [*] Use native graphics initialization
    display
        - (nothing checked)
    generic drivers
        - [*] Support Intel PCI-e WiFi adapters
        - [*] PS/2 keyboard init
    console
        - [*] Squelch AP CPUs from early console.
          [*] Show POST codes on the debug console
    system tables
        - [*] Generate SMBIOS tables
    payload
        - Add a payload (SeaBIOS)
        - SeaBIOS version (master)
        - (3000) PS/2 keyboard controller initialization timeout (milliseconds)
        - [*] Harware init during option ROM execution
        - [*] Include generated option rom that implements legacy VGA BIOS compatibility
        - [*] Use LZMA compression for payloads
    debugging
        - (nothing checked)
    • Compile coreboot!
    make crossgcc-i386 CPUS=4
    make iasl
    make

    EDIT – 2016-11-27 Andreas Sinninger pointed out I was missing the path to the Intel ME/TXE firmware – corrected.

  14. FINALLY! Flash your new coreboot.rom to your rom chip:

    pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash01.bin
    pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash02.bin
    pi@raspberrypi:~$ md5sum flash01.bin flash02.bin  # if these don't match, stop, turn off the pi, fiddle with the Pomona clip, repeat this step
    pi@raspberrypi:~$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -w ~/coreboot/build/coreboot.rom

If your laptop boots up to a SeaBIOS screen at this point: you win! If not, don’t despair, you can flash flash01.bin to go back to your old BIOS, or, better yet, keep compiling until it works.

Resources

These are some general resources without which my X220 would be a pathetic pile of smashed up silicon by now.