Coreboot is an Open Source project, which replaces the proprietary BIOS of a traditional computer. Coreboot initialize the Hardware and then executes a payload (e. g. SeaBIOS or Grub).

Warning

The procedure of flashing coreboot could lead to a bricked notebook, only proceed with this guide if you know the risks!

Only attach wires with removed battery and power not connected to the Raspberry Pi!

Things required

Lenovo ThinkPad T430

Raspberry Pi (In this tutorial version 3 is used)

SO8 test clip or a soldering iron (e.g. Pomona SOIC8 5250 Test Clip)

8x Female Jumper Wire

Another computer to communicate with the raspberry pi

ThinkPad T430 Disassembly

I will not go into detail for the disassembly of the Thinkpad T430.

There are already enough tutorials and YouTube videos online.

To flash coreboot on the T430 the motherboard should be completely removed, to have access to the bios flash chips.

Getting started

In this tutorial a Raspberry Pi is used to flash coreboot.

Update the Raspberry Pi.

$ sudo apt-get update $ sudo apt-get dist-upgrade

Install the required software.

$ sudo apt-get install libftdi1 libftdi-dev libusb-dev libpci-dev \ m4 bison flex libncurses5-dev libncurses5 build-essential pciutils \ usbutils libpci-dev libusb-dev libftdi1 libftdi-dev zlib1g-dev subversion \ libusb-1.0 gnat-4.9 gnat wget zlib1g-dev

Get flashrom, build it and install it.

$ git clone https://github.com/flashrom/flashrom $ cd flashrom $ make $ sudo make install

Modprobe the SPI driver.

$ sudo modprobe spi_bcm2835 $ sudo modprobe spidev

Enable the SPI device on the Raspberry Pi.

$ sudo raspi-config > 5 Interfacing Options Configure connections to peripherals > P4 SPI Enable/Disable automatic loading of SPI kernel module > Would you like the SPI interface to be enabled? > Yes $ sudo reboot

Read the current proprietary BIOS from the flash chips

Now it is time to read the proprietary BIOS blob from the Lenovo T430.



There are two SPI flash chips on the motherboard.

U46 U66 MXIC MX winbond 25L3206E 26064FVSIG M21-12G 1317 3L860700 K131576

Pinlayout of the SO8 SPI Chips

__ MOSI 5 =| |= 4 GND CLK 6 =| |= 3 NC NC 7 =| |= 2 MISO VCC 8 =|_*|= 1 CS (dot on top of the chip)

Pinlayout of the Raspberry Pi

e +-----+ d | o o <- GND g | o o | e | o o | | o o | o | o o | f | o o | | o o | R | o o | a CS -> o o <- CLK s | o o <- MISO p | o o <- MOSI b | o o <- 3.3V e | o o | r | o o | r | o o | y | o o | | o o | P | o o | i | o o | | o o | +-----+

Read from the 8MB flash (UE46)



Check if flashrom detects the flash chip.

$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 flashrom v0.9.9-47-gaa91d5c on Linux 4.9.35-v7+ (armv7l) flashrom is free software, get the source code at https://flashrom.org Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) on linux_spi. No operations were specified.

I am a very paranoid person, so dump the flash three times.

$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash01.bin flashrom v0.9.9-47-gaa91d5c on Linux 4.9.35-v7+ (armv7l) flashrom is free software, get the source code at https://flashrom.org Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) on linux_spi. Reading flash... done.

$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash02.bin flashrom v0.9.9-47-gaa91d5c on Linux 4.9.35-v7+ (armv7l) flashrom is free software, get the source code at https://flashrom.org Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) on linux_spi. Reading flash... done.

$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r flash03.bin flashrom v0.9.9-47-gaa91d5c on Linux 4.9.35-v7+ (armv7l) flashrom is free software, get the source code at https://flashrom.org Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) on linux_spi. Reading flash... done.

Compare the checksum of the three dumps.

$ md5sum flash*.bin 60e2d8334870e1647653102f19721b8a flash01.bin 60e2d8334870e1647653102f19721b8a flash02.bin 60e2d8334870e1647653102f19721b8a flash03.bin

Read from the 4MB flash (UE66)

sudo flashrom -p linux_spi:dev=/dev/spidev0.0 flashrom v0.9.9-47-gaa91d5c on Linux 4.9.35-v7+ (armv7l) flashrom is free software, get the source code at https://flashrom.org Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). Found Macronix flash chip "MX25L3205(A)" (4096 kB, SPI) on linux_spi. Found Macronix flash chip "MX25L3205D/MX25L3208D" (4096 kB, SPI) on linux_spi. Found Macronix flash chip "MX25L3206E/MX25L3208E" (4096 kB, SPI) on linux_spi. Found Macronix flash chip "MX25L3273E" (4096 kB, SPI) on linux_spi. Multiple flash chip definitions match the detected chip(s): "MX25L3205(A)", "MX25L3205D/MX25L3208D", "MX25L3206E/MX25L3208E", "MX25L3273E" Please specify which chip definition to use with the -c option.

In this case the “MX25L3206E/MX25L3208E” is on the motherboard.

Same here.. I am a very paranoid person, so dump the flash three times.

sudo flashrom --programmer linux_spi:dev=/dev/spidev0.0 --chip "MX25L3206E/MX25L3208E" -r flash01b.bin flashrom v0.9.9-r1955 on Linux 4.4.10-1-ARCH (armv7l) flashrom is free software, get the source code at https://flashrom.org Calibrating delay loop... OK. Found Macronix flash chip "MX25L3206E/MX25L3208E" (4096 kB, SPI) on linux_spi.

sudo flashrom --programmer linux_spi:dev=/dev/spidev0.0 --chip "MX25L3206E/MX25L3208E" -r flash02b.bin flashrom v0.9.9-r1955 on Linux 4.4.10-1-ARCH (armv7l) flashrom is free software, get the source code at https://flashrom.org Calibrating delay loop... OK. Found Macronix flash chip "MX25L3206E/MX25L3208E" (4096 kB, SPI) on linux_spi.

sudo flashrom --programmer linux_spi:dev=/dev/spidev0.0 --chip "MX25L3206E/MX25L3208E" -r flash03b.bin flashrom v0.9.9-r1955 on Linux 4.4.10-1-ARCH (armv7l) flashrom is free software, get the source code at https://flashrom.org Calibrating delay loop... OK. Found Macronix flash chip "MX25L3206E/MX25L3208E" (4096 kB, SPI) on linux_spi.

Compare the checksum of the three dumps.

$ md5sum flash*b.bin 76b424b99dd6fee6f4246db4c4f311ff flash01b.bin 76b424b99dd6fee6f4246db4c4f311ff flash02b.bin 76b424b99dd6fee6f4246db4c4f311ff flash03b.bin

Extract the binary blobs

,

The two dumps have to be merged in the order 8MB+4MB.

cat flash01.bin flash01b.bin > flash.bin

Cloning the coreboot git. and recursively clone the necessary other gits.

$ git clone --recursive https://github.com/coreboot/coreboot $ cd ~/coreboot/3rdparty $ git clone http://review.coreboot.org/p/blobs.git

Build and install the extraction tool for the binary blobs.

$ cd ~/coreboot/util/ifdtool $ make $ sudo make install

Copy the binary blobs to the build directory of coreboot.

$ cd ~ $ ifdtool -x ~/flash.bin $ mkdir -p ~/coreboot/3rdparty/blobs/mainboard/lenovo/t430 $ cd ~/coreboot/3rdparty/blobs/mainboard/lenovo/t430 $ mv ~/flashregion_0_flashdescriptor.bin descriptor.bin $ mv ~/flashregion_2_intel_me.bin me.bin $ mv ~/flashregion_3_gbe.bin gbe.bin

Configure coreboot

$ cd ~/coreboot/ $ make nconfig

This is one possible configuration

general - [*] Compress ramstage with LZMA - [*] Include coreboot .config file into the ROM image - [*] Allow use of binary-only repository mainboard - Mainboard vendor (Lenovo) - Mainboard model (ThinkPad T430) - ROM chip size (12288 KB (12 MB)) - (0x100000) Size of CBFS filesystem in ROM chipset - [*] Enable VMX for virtualization - Include CPU microcode in CBFS (Generate from tree) - Flash ROM locking on S3 resume (Don't lock ROM sections on S3 resume) - [*] Add Intel descriptor.bin file (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/descriptor.bin) Path and filename of the descriptor.bin file - [*] Add Intel ME/TXE firmware (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/me.bin) Path to management engine firmware - [*] Add gigabit ethernet firmware (3rdparty/blobs/mainboard/$(MAINBOARDDIR)/gbe.bin) Path to gigabit ethernet firmware devices - [*] Use native graphics initialization display - (nothing checked) generic drivers - [*] Support Intel PCI-e WiFi adapters - [*] PS/2 keyboard init console - [*] Squelch AP CPUs from early console. [*] Show POST codes on the debug console system tables - [*] Generate SMBIOS tables payload - Add a payload (SeaBIOS) - SeaBIOS version (master) - (3000) PS/2 keyboard controller initialization timeout (milliseconds) - [*] Harware init during option ROM execution - [*] Include generated option rom that implements legacy VGA BIOS compatibility - [*] Use LZMA compression for payloads debugging - (nothing checked)

$ make crossgcc-i386 CPUS=4 $ make iasl $ make

Important note: Be sure to have enough space left on the Raspberry Pi.

Furthermore the compiling process on the Raspberry Pi takes a lot of time…

If you want to speed up, compile it on a standard computer.

It is only necessary to flash the 4MB flash UE66. So extract the last 4MB out of the coreboot rom.

$ dd if=build/coreboot.rom bs=1M of=/tmp/t430.rom skip=8

Flash the 4MB UE66 with the extracted 4MB coreboot rom.

$ sudo flashrom --programmer linux_spi:dev=/dev/spidev0.0 --chip "MX25L3206E/MX25L3208E" --write t430.rom

Booting Coreboot with SeaBIOS payload

If everything went well, the Thinkpad T430 is ready to boot coreboot.

Image of the booting process:



Short video of the booting process (very unspectacular):



Some images

Just some images I have done.

Furthermore I have wired the flash chips to the maintenance flap, which is not necessary!



Problems

Error extracting binary blobs

If the idftool has an error message in the output, possible problems could be the dump of the proprietary BIOS was not successful or the two dumps have not been merged (8MB + 4MB).

ifdtool -x flash01.bin File /home/pi/flash01.bin is 8388608 bytes Flash Region 0 (Flash Descriptor): 00000000 - 00000fff Flash Region 1 (BIOS): 00500000 - 00bfffff Error while writing: Success Flash Region 2 (Intel ME): 00003000 - 004fffff Flash Region 3 (GbE): 00001000 - 00002fff Flash Region 4 (Platform Data): 00fff000 - 00000fff (unused)

The Laptop does absolutely nothing

After I reassembled the laptop it does absolutely nothing. The fan was not rotating and the power led was off.

I disassembled it again and found a short circuit by two pins of a plug.



Get help online

https://www.coreboot.org/Welcome_to_coreboot

Very friendly people in the IRC: http://webchat.freenode.net/?channels=coreboot

Mailinglist: https://www.coreboot.org/Mailinglist

References