[[!img coreboot.png align="right" alt="coreboot logo"]]

## n00bie guide for getting [[coreboot|http://www.coreboot.org/Welcome_to_coreboot]] to a x201{i/s/t}

###why would I want this?
- prevent [[badBIOS|https://www.schneier.com/blog/archives/2013/11/badbios.html]]
- free open source BIOS / EFI implementation
- fast (faster than Lenovo BIOS)
- no PCI ID whitelist restrictions (WiFi / WWAN)
- you can boot even with SATA-password set (for example to change/delete it with hdparm)
- hotswap harddrive (didn't test, but should work)
- it's cool.

###okay, show me how!
#### preliminary actions
first you should update your existing BIOS. This is important as you cannot update your [[ECP|http://www.thinkwiki.org/wiki/Embedded_Controller_Firmware]] version afterwards. Linux users can use the ISO files provided by Lenovo and do some nice trick described [[here|http://www.thinkwiki.org/wiki/BIOS_update_without_optical_disk]]

It is also advisable to save the output of dmidecode somewhere, as you need specific BIOS versions strings to get thinkpad_acpi to work.

next buy or build a SPI flasher and get a SOIC8 clip for mounting the chip correctly.

#### the ugly part
you have to dump the existing BIOS using [[flashrom|http://www.flashrom.org]] and an external SPI flasher.
here's the pinout:
[[!format bash """
  ====  front (display) =====
3.3V     N/C      CLK      MOSI
 |        |        |        |
 |        |        |        |
CS       MISO     N/C      ground
  ====  back (touchpad) =====
"""]]

[[!img bus_pirate.jpg align="right" size="320x240" alt="buspirate attached"]]
Now it should look similar to this:

You probably have to adjust your contacts quite often for it to work, so don't give up ;) try to keep the cables as short as possible.


now read your chip at least twice with

[[!format bash """
flashrom -p <yourprogrammer> -r flash.bin
flashrom -p <yourprogrammer> -r flash2.bin
diff flash.bin flash2.bin
"""]]

If the files differ you have read errors
-> bad: check your cables && try again.

#### easy part
- extract descriptor / intel ME
[[!format bash """
dd if=flash.bin of=coreboot/3rdparty/mainboard/lenovo/x201/descriptor.bin \
   count=12288 bs=1M iflag=count_bytes
dd if=flash.bin of=coreboot/3rdparty/mainboard/lenovo/x201/me.bin \
   skip=12288 count=5230592 bs=1M iflag=count_bytes,skip_bytes
"""]]
- extract vgabios.bin from BIOS (I used [[PhoenixTool|http://forums.mydigitallife.info/threads/13194-Tool-to-Insert-Replace-SLIC-in-Phoenix-Insyde-Dell-EFI-BIOSes]] in a WinBitch VM for this, as the included bios extractor from coreboot didn't work for me) 
- hint [[SWIM|http://www.urbandictionary.com/define.php?term=swim]] [[uploaded|https://www.datafilehost.com/d/4c01e3d8]] [[it|https://random.to/feminism/vgabios.bin]] [[somewhere|https://yadi.sk/d/P46i4TpKtCKVH]] in the internets
- use your prior version number for local version string (e.g [["6QET70WW (1.40)"|http://www.thinkwiki.org/wiki/List_of_DMI_IDs]])
- at least UNCHECK fake IFD and specify paths to descriptor / ME
- select SeaBIOS as payload
- DO NOT FORGET vgabios.bin
- [[compile coreboot|http://www.coreboot.org/Build_HOWTO]] (you'll need gcc-multilib and your python bin should point to python2, else create a venv)
- flash resulting ROM image with
[[!format bash """ 
flashrom -c $Chip -w coreboot/build/coreboot.rom -p internal:laptop=force_I_want_a_brick """]]

credits to Vladimir Serbinenko (coreboot developer) for answering to all my questions and fixing minor problems.

## additional pics
[[!img chip_location.jpg alt="Chip location" size="320x240"]]
[[!img soic_clip.jpg alt="SOIC mount" size="320x240"]]
[[!img self_build_spi.jpg alt="SPI flasher" size="320x240"]]

## additional links
[[Coreboot wiki page for x201|http://www.coreboot.org/Board:lenovo/x201]]
[[BIOS extract|http://www.coreboot.org/Bios_extract]]
[[feel free to contact me|/People/jackrandom]]