Coreboot guide for X220

[t-padlover]

Hello,

Is there somewhere a detailed guide how to install coreboot on Thinkpad X220? Where everything is explained from making a build, backing up the original Lenovo BIOS to how to connect the right pins of the right tool to the chip?

[shawross]

It is quite interesting to me that people crave coreboot. They must consider that it will offer privacy obviously during the boot process. This comes from knowledge of Intel ME and the unknown of what that entails.

The reason I say this is because of the risks involved. Are the risks worth the effort?

Do we trust Intel?

We generally have gone from Bios to UEFI booting and what are the results of that? Do you have more privacy now?

Who has been a driving force behind Coreboot and even installs Coreboot on its own systems? Do you trust them?

[TPFanatic]

i once was sold an X230 with Coreboot flashed on it. i spent the next few days figuring out how to use the skulls software flasher to flash 1vyra1n onto the laptop. that was not fun and i don't want to do it ever again.

[t-padlover]

It is quite interesting to me that people crave coreboot. They must consider that it will offer privacy obviously during the boot process. This comes from knowledge of Intel ME and the unknown of what that entails.

The reason I say this is because of the risks involved. Are the risks worth the effort?

Do we trust Intel?

We generally have gone from Bios to UEFI booting and what are the results of that? Do you have more privacy now?

Who has been a driving force behind Coreboot and even installs Coreboot on its own systems? Do you trust them?

what are the risks?

[shawross]

Well this is a risk of bricking your X220 and this can be difficult to remedy if at all.

Secondly you don't know if you actually have more privacy after the process is completed.

You could actually gain more privacy in Bios mode rather than UEFI or coreboot.

This is difficult to measure. Although I currently run an X220 in dual boot "Bios" mode with Windows 7 and Linux Mint.

Running in dual boot mode can cause Windows and Linux to communicate with each other although I think this
is mediated by installing in "Bios" mode to a certain degree.

I can't provide proof either way so it is trial and error to a degree. Boot partitions tend to be increasing in size
and not decreasing. I have read Linux articles where they suggest having a boot partition of 1 GB.

If you intend to install Coreboot feel free to experiment and provide feedback.

[axur-delmeria]

There's a non-trivial risk of bricking your laptop and being unable to restore it because the BIOS image you read from the flash chip is corrupt despite following the instructions perfectly. I've mentioned this in Coreboot-related threads I encounter in this forum: the instructions for backing up the original BIOS makes unsafe assumptions with regards to whether the data read from the flash chip is "valid" or "correct" and the method it presents for testing its validity is not comprehensive enough.

If would be a lot safer if it were possible to remove the original flash chip, solder a socket in its place, then flash the coreboot image to a new, empty chip and install that into the socket. But no... you have to overwrite the original chip even though there's no 100% guarantee that the firmware image you read from it is actually correct(!!)

[DarkSamus9000]

I flashed libreboot to my X220 with utmost ease. Every other reply in this thread makes it sound too dangerous to attempt. It's really not that bad. There are two simple precautions you need to follow:

Measure twice, cut once
CREATE BACKUPS!

Measure twice, cut once - if you are reading a ROM from your flash chip, read it twice & compare checksums. My rule of thumb is 2 consecutive reads with identical checksums. If you're paranoid (like me), do 3 consecutive reads!
Likewise, if you are writing a ROM to your flash chip, perform a verification after the write & make sure what was written to the chip matches the ROM file you intended to write.

Create backups! Should go without saying. You need to read the original BIOS ROM off of the flash chip (using the "measure twice, cut once" axiom) and store this in a secure place. That way if anything goes wrong with coreboot, you can always re-flash the original BIOS ROM and restore your machine to working order.

I've never built coreboot (only used libreboot), so I can't help you with building a ROM; but once you have a BIOS ROM built & ready to be flashed, the process for disassembling the laptop & flashing the ROM will be the same whether you've used libreboot's build system or coreboot directly.
You can find disassembly guides online, but TL;DR the BIOS chip is underneath the palmrest. You'll only need to remove the keyboard & the palmrest to expose the chip.
Libreboot's website is a good place to start learning about external SPI flashing. This page right here (https://libreboot.org/docs/install/spi.html) shows you the pinout of the SOIC-8 package (most common form for BIOS chips) and the corresponding pinout on the Raspberry Pi Pico, a $5 microcontroller you can buy to flash the BIOS.
To perform external flashing, you'll need
1. Microcontroller (e.g. raspberry pi pico w/ pre-soldered headers) + USB micro type B cable (OR a full-fledged raspberry pi or equivalent single-board computer also works)
2. A clip for your BIOS chip - either SOIC-16 or SOIC-8 (most common, I had it on my X220)
3. Dupont wires to connect your clip to your programmer (e.g. https://a.co/d/en6sQvH)

If you have any more specific questions, we can try to help you further.