Robert Monahan Blog

Corebooting a Lenovo ThinkPad X201 Tablet using a Raspberry Pi

This tutorial will walk you though how to get Coreboot on to a ThinkPad X201 Tablet using a Raspberry Pi as the programmer. Although it should be a paint by numbers for the X201 series, I suggest you read though the X201 guide (or the guide for your board) and the how to build Coreboot guide. More info can be found at the Coreboot wiki, and the Flashrom wiki.

WARNING!

Whenever your flashing firmware there is always a risk of bricking your computer. I am not responsible for any damage that comes to your computer or your Raspberry Pi as a result of this tutorial. Continue at your own risk!

I'm using a Raspberry Pi 3 Model B but any Raspberry Pi or supported programmer will work. The X201s, X201t, and X201 should also have a nearly identical process for flashing Coreboot. Many other ThinkPads will have a similar flash process as well, but if you do not have a Lenovo ThinkPad X201 check out Coreboot's list of supported laptops. Corebooting your X201 will cause some features of the laptop to stop functioning properly so before continuing look at the issues that occur when the X201 is Corebooted.

Why Coreboot your X201

Here are few reasons why I decided to Coreboot my laptop.

  1. Using Coreboot gives you more freedom and control over your system. Although the Intel Management Engine will remain in the firmware, I believe removing the vendor BIOS is a step in the right direction towards user freedom.
  2. Most importantly it's fun to play around with computers
  3. The Thinkpad I received had a BIOS lock that prevented booting, so it was either Coreboot or Landfill.
  4. Also it boots a bit quicker which is a nice side effect.

Supplies

Installing Flashrom onto your Raspberry Pi

If you want more info on using Flashrom on the Raspberry Pi look at the Flashrom wiki entry for Raspberry Pi.

Install dependencies for Flashrom, and then download and install Flashrom

sudo apt-get update
sudo apt-get install pciutils libftdi-dev libusb-dev libpci-dev libusb-1.0
sudo git clone https://github.com/stefanct/flashrom.git
cd flashrom
sudo make
sudo make install

Run the following commands to ensure everything installed properly:

modprobe spi_bcm2835
modprobe spidev

If that fails try the older spi_bcm2708 module instead

Next we'll need to expand the Raspberry Pi's file system and enable SPI flashing

sudo raspi-config
--> 5 Interfacing Options
    --> P4 SPI
--> 7 Advanced options
    --> A1 Expand Filesystem
sudo reboot

Opening and Locating the flash chip

Remove the battery and disconnect the laptop from power. Now is also a good time to remove the hard drive just in case some thing goes wrong, so you won't damage the drive.

Remove the 4 screws on the underside of the laptop labeled for the keyboard

The Underside of the Lenovo X201 Tablet with the screw to remove the keyboard highlighted.

Open the Laptop by sliding the keyboard away from you and towards the monitor. You will see a small gap between the keyboard and trackpad. Now simply lift up the keyboard.

The Lenovo X201 Tablet with the keyboard lifted up.

The flash chip is concealed under plastic just above the backup battery. Carefully cut away enough plastic to gain access to the chip. Avoid touching the board with your scissors or craft knife, as it is very easy to damage the on board components.

The Lenovo X201 Tablet opened with the SPI flash chip highlighted.

Wiring up the RaspberryPi to the flash

Now it's time to wire the SPI clip to the Raspberry Pi by following the diagram below.

The SPI flash chip wired to the Raspberry Pi.

I found this diagram on the X201 flash layout here.

Flash chip on X201

^ Towards LCD display (i.e. away from you)
|

(red)         (violet) (gray)
 3.3V            CLK    MOSI
 _|_______|_______|_______|_
|                           |
| 8       7       6       5 |
|                           |
|                           |
| 1       2       3       4 |
|___________________________|
  |       |       |       |
  CS     MISO            GND
(white) (black)        (brown)

|
v Towards front edge of laptop base (i.e. towards you)

Raspberry Pi

^ Towards edge of pi
|
                                                                                                 (white)
L                                                                                                   CS
E   _|_______|_______|_______|________|________|________|________|________|________|________|________|________|________|________|________|________|________|________|________|_
F  |                                                                                                                                                                           |
T  | 2       4       6       8       10       12       14       16       18       20       22       24       26       28       30       32       34       36       38       40 |
   |                                                                                                                                                                           |
E  |                                                                                                                                                                           |
D  | 1       3       5       7        9       11       13       15       17       19       21       23       25       27       29       31       33       35       37       39 |
G  |___________________________________________________________________________________________________________________________________________________________________________|
E    |       |       |       |        |        |        |        |        |        |        |        |        |        |        |        |        |        |        |        |
                                                                        3.3V      MOSI     MISO     CLK      GND
                                                                        (red)    (gray)   (black) (violet) (brown)
|
v Towards CPU & body of pi

Reading the Flash

Check to see if you can read the flash chip with the command: flashrom -p {yourProgrammer} -r {readToFileName}

sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r x201_test.bin

If the chip was read properly it should print out

flashrom v0.9.9-unknown on Linux 4.9.22-v7+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6405" (8192 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E" (8192 kB, SPI) on linux_spi.
Multiple flash chip definitions match the detected chip(s): "MX25L6405", "MX25L6405D", "MX25L6406E/MX25L6408E", "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E"
Please specify which chip definition to use with the -c <chipNumber> option.

If it prints out an error or "NO EEPROM/flash device found," then check your connections and try again. If you continue to have issues reading the flash chip, you may not be supplying enough power to the chip. You can try plugging in the power adapter instead of the 3.3v from the Pi. DO NOT have the 3.3v and the power adapter plugged in at the same time.

Make a note of what chip you have on your board in my case I have the MX25L6445E which has 8192 kB of storage

The SPI flash chip with the chip number highlighted

Time to take a break from Flashrom and work on getting Coreboot ready.

Installing Coreboot onto the RaspberryPi

I highly suggest you read Coreboot's how to build guide

Note: The Raspberry Pi doesn't need to be connected to the X201 chip to build Coreboot.

Install the dependencies and download Coreboot.

apt-get install git build-essential flex bison libncurses5-dev wget zlib1g-dev
git clone http://review.coreboot.org/p/coreboot
cd coreboot
git submodule update --init --checkout

Configuring Coreboot

While in the "coreboot" directory you can configure Coreboot with

  make nconfig 

These were the options I used for my Coreboot build.

general
    - [*] Compress ramstage with LZMA
    - [*] Include coreboot .config file into the ROM image
    - [*] Allow use of binary-only repository
mainboard
    -  Mainboard vendor (Lenovo)
    -  Mainboard model (ThinkPad X201 / X201S / X201T)
    -  ROM chip size (8192 KB (8 MB))
    -  (0x100000) Size of CBFS filesystem in ROM
chipset
    - [*] Enable VMX for visualization
    -  Include CPU microcode in CBFS (Generate from tree)
    -  Flash ROM locking on S3 resume (Don't lock ROM sections on S3 resume)
    - [*] Add Intel descriptor.bin file
(3rdparty/blobs/mainboard/$(MAINBOARDDIR)/descriptor.bin) Path and filename of the descriptor.bin file
    - [*] Add Intel ME/TXE firmware
(3rdparty/blobs/mainboard/$(MAINBOARDDIR)/me.bin) Path to management engine firmware
    - [*] Verify the integrity of the supplied ME/TXE firmware
devices
    - [*] Use native graphics initialization
display
    - (nothing checked)
generic drivers
    - [*] Support Intel PCI-e WiFi adapters
console
    - [*] Squelch AP CPUs from early console.
    - [*] Show POST codes on the debug console
system tables
    - [*] Generate SMBIOS tables
payload
    - Add a payload (SeaBIOS)
    - SeaBIOS version (master)
    - (3000) PS/2 keyboard controller initialization timeout (milliseconds)
    - [*] Hardware init during option ROM execution
    - [*] Include generated option rom that implements legacy VGA BIOS compatibility
    - [*] Use LZMA compression for payloads
    - Secondary Payloads --> (feel free to add any or all Secondary Payloads although none are required)
debugging
    - (nothing checked)

Save as the default configure file: "/home/{user}/coreboot/.config", Then exit

Building & Flashing Coreboot ROM

Connect the Raspberry Pi to the X201 and you'll need to read the flash twice, using Flashrom with the command: flashrom -c {yourChip} -p {yourProgrammer} -r {readToFileName}

flashrom -c MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E -p linux_spi:dev=/dev/spidev0.0 -r flash01.bin
flashrom -c MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E -p linux_spi:dev=/dev/spidev0.0 -r flash02.bin

Now compare the hashes of the two files, If they do not match something went wrong. Adjust the clip and check all your connections.

md5sum flash01.bin flash02.bin

WARNING!

Do not continue until you have two copies of the flash that match otherwise you risk bricking your computer without a way to recover.

Once you have 2 good reads back these up externally in case you ever need to restore the original BIOS.

All modern Intel boards require the Intel Management Engine (ME) & the Intel Flash Descriptor region (descriptor). This is in the flash chip that we are about flash with Coreboot, so you'll need to pull out the Intel ME and descriptor (and some boards have a gigabyte Ethernet region as well).

More info on the X201 flash layout.

First you'll create the destination directory if they don't already exist.

make dir /3rdparty/blobs/mainboard/lenovo
make dir /3rdparty/blobs/mainboard/lenovo/x201

Now pull the ME and descriptor from the flash.bin file that you just read from the flash chip.

dd if=flash01.bin of=coreboot/3rdparty/blobs/mainboard/lenovo/x201/descriptor.bin count=12288 bs=1M iflag=count_bytes
dd if=flash01.bin of=coreboot/3rdparty/blobs/mainboard/lenovo/x201/me.bin skip=12288 count=5230592 bs=1M iflag=count_bytes,skip_bytes

Now you are ready to build the Coreboot ROM.

make crossgcc-i386 CPUS=4

or if that dosen't work try

make crossgcc-i386

This will take a long time.

Next you'll need to make the Coreboot ROM

make iasl
make

As long as there were no errors we are ready to flash the new Coreboot ROM onto the flash chip. Move into the "coreboot/build/" directory where the "coreboot.rom" that you just created is located. Then flash Coreboot.

cd build/
flashrom -c MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E -p linux_spi:dev=/dev/spidev0.0 -w coreboot.rom

As long as there are no errors you are ready to boot up your X201.

Congratulations you're done! Enjoy your new Corebooted Thinkpad.

Resources