blob: a04abfe70b77f29522906aeaca1a5253eb330673 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
[[!img coreboot.png align="right" alt="coreboot logo"]]
## n00bie guide for getting [[coreboot|http://www.coreboot.org/Welcome_to_coreboot]] to a x201{i/s/t}
###why would I want this?
- prevent [[badBIOS|https://www.schneier.com/blog/archives/2013/11/badbios.html]]
- free open source BIOS / EFI implementation
- fast (faster than Lenovo BIOS)
- no PCI ID whitelist restrictions (WiFi / WWAN)
- you can boot even with SATA-password set (for example to change/delete it with hdparm)
- hotswap harddrive (didn't test, but should work)
- it's cool.
###okay, show me how!
#### preliminary actions
first you should update your existing BIOS. This is important as you cannot update your [[ECP|http://www.thinkwiki.org/wiki/Embedded_Controller_Firmware]] version afterwards. Linux users can use the ISO files provided by Lenovo and do some nice trick described [[here|http://www.thinkwiki.org/wiki/BIOS_update_without_optical_disk]]
It is also advisable to save the output of dmidecode somewhere, as you need specific BIOS versions strings to get thinkpad_acpi to work.
next buy or build a SPI flasher and get a SOIC8 clip for mounting the chip correctly.
#### the ugly part
you have to dump the existing BIOS using [[flashrom|http://www.flashrom.org]] and an external SPI flasher.
here's the pinout:
[[!format bash """
==== front (display) =====
3.3V N/C CLK MOSI
| | | |
| | | |
CS MISO N/C ground
==== back (touchpad) =====
"""]]
[[!img bus_pirate.jpg align="right" size="320x240" alt="buspirate attached"]]
Now it should look similar to this:
You probably have to adjust your contacts quite often for it to work, so don't give up ;) try to keep the cables as short as possible.
now read your chip at least twice with
[[!format bash """
flashrom -p <yourprogrammer> -r flash.bin
flashrom -p <yourprogrammer> -r flash2.bin
diff flash.bin flash2.bin
"""]]
If the files differ you have read errors
-> bad: check your cables && try again.
#### easy part
- extract descriptor / intel ME
[[!format bash """
dd if=flash.bin of=coreboot/3rdparty/mainboard/lenovo/x201/descriptor.bin \
count=12288 bs=1M iflag=count_bytes
dd if=flash.bin of=coreboot/3rdparty/mainboard/lenovo/x201/me.bin \
skip=12288 count=5230592 bs=1M iflag=count_bytes,skip_bytes
"""]]
- extract vgabios.bin from BIOS (I used [[PhoenixTool|http://forums.mydigitallife.info/threads/13194-Tool-to-Insert-Replace-SLIC-in-Phoenix-Insyde-Dell-EFI-BIOSes]] in a WinBitch VM for this, as the included bios extractor from coreboot didn't work for me)
- hint [[SWIM|http://www.urbandictionary.com/define.php?term=swim]] [[uploaded|https://www.datafilehost.com/d/4c01e3d8]] [[it|https://random.to/feminism/vgabios.bin]] [[somewhere|https://yadi.sk/d/P46i4TpKtCKVH]] in the internets
- use your prior version number for local version string (e.g [["6QET70WW (1.40)"|http://www.thinkwiki.org/wiki/List_of_DMI_IDs]])
- at least UNCHECK fake IFD and specify paths to descriptor / ME
- select SeaBIOS as payload
- DO NOT FORGET vgabios.bin
- [[compile coreboot|http://www.coreboot.org/Build_HOWTO]] (you'll need gcc-multilib and your python bin should point to python2, else create a venv)
- flash resulting ROM image with
[[!format bash """
flashrom -c $Chip -w coreboot/build/coreboot.rom -p internal:laptop=force_I_want_a_brick """]]
credits to Vladimir Serbinenko (coreboot developer) for answering to all my questions and fixing minor problems.
## additional pics
[[!img chip_location.jpg alt="Chip location" size="320x240"]]
[[!img soic_clip.jpg alt="SOIC mount" size="320x240"]]
[[!img self_build_spi.jpg alt="SPI flasher" size="320x240"]]
## additional links
[[Coreboot wiki page for x201|http://www.coreboot.org/Board:lenovo/x201]]
[[BIOS extract|http://www.coreboot.org/Bios_extract]]
[[feel free to contact me|/People/jackrandom]]
|
