The wiki is being retired!
Documentation is now handled by the same processes we use for code: Add something to the Documentation/ directory in the coreboot repo, and it will be rendered to https://doc.coreboot.org/. Contributions welcome!
Back up the original proprietary firmware
- Download, extract, and build the latest Libreboot binaries.
- From the
- Run both of these commands to backup the BIOS to
factory.bin(don't panic, nothing is being installed):
sudo ./flashrom/i686/flashrom_lenovobios_sst -p internal -r factory.bin
sudo ./flashrom/i686/flashrom_lenovobios_macronix -p internal -r factory.bin
- This will have created a file called "factory.bin", which is the contents of the flash chip while it had the original "BIOS" firmware. Back this up to a safe place (it can be useful for potential reverse engineering work, or for other testing).
- The source code for this version of flashrom can also be found on the libreboot website. It is a patched flashrom executable, to work around security restrictions in the original Lenovo BIOS (it will also be used for flashing, later on in this guide); the patches for it in libreboot can be found under resources/flashrom/patch/.
- There are two flash chips for the X60/T60. The instructions above simply used flashrom executables for both; one failed, and one should have succeeded. This is much easier than finding out what flash chip you have before hand (which involved elaborate hacks in flashrom, reading output, or taking apart the laptop and physically looking at the chip).
Video BIOS (VGA option ROM)
On systems with Intel graphics, native graphics initialization code exists in coreboot. However, if you want to use the Intel (proprietary) Video BIOS, you should extract this from the factory.bin dump that you created earlier. If your system has ATI graphics (common on the T60), this is required.
VGA support page on the coreboot wiki tells you how to extract it.
Place this inside the coreboot/ directory, and in menuconfig enable it under Devices if you are using payloads other than SeaBIOS (for SeaBIOS, you should configure SeaBIOS to run it. Coreboot's default SeaBIOS configuration will use it). In either scenario, you will want to include it in the ROM image, so make sure to specify the path "vgabios.bin" (or whatever the path to your VBIOS image is) in menuconfig, making sure to enter the correct numbers for the PCI ID (get this using lspci -nn).
Patch the coreboot ROM image for bucts
Failure to follow this will result in a bricked laptop.
Method 1: One-line Patcher
- Place the
coreboot.romfile in the current directory.
- Run this one-liner to patch the ROM in one command:
dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k; dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump; dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc
Backup Control Top Swap.
- Copy the built
flashromsource code directory.
- Run the
ddcommand below to shift the first 64K of data from
dd if=coreboot.rom of=top64k.bin bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x10000] count=64k
- Run the dd command below to display the first 64k of
dd if=coreboot.rom bs=1 skip=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k | hexdump
- Verify that the complete range is filled with
ffbytes before proceeding.
- The output of the
ddcommand above must EXACTLY match the text below. If not, the coreboot image needs to be rebuilt with the second-to-last 64kbyte block unused.
0000000 ffff ffff ffff ffff ffff ffff ffff ffff *0010000
- The output of the
- Run the
dd if=top64k.bin of=coreboot.rom bs=1 seek=$[$(stat -c %s coreboot.rom) - 0x20000] count=64k conv=notrunc
What this did was copy the upper 64KiB section of the ROM image, into the section below. This is the boot block; lenovobios prevents writing to the upper 64KiB block (by default, it prevents all other regions but a patched flashrom binary can flash those regions in software). A utility called bucts will be used later on to set the system up so that it boots from the before-final 64KiB block during the initial installation of coreboot.
- Source: gmane.linux.bios Mailing List - LinuxBIOS on T60 - Peter Stuge's Method of installing Coreboot on the X60.
Install Coreboot (First Flash)
First, install Coreboot alongside the vendor BIOS.
As before, you will be using the patched version of flashrom distributed in libreboot. The binary releases of libreboot come with both bucts and flashrom already compiled (you can also build them from source, if you like). You can also get bucts and flashrom from upstream (optional):
The libreboot project also distributes ROM images already compiled for the X60/T60, if you prefer (for T60, please avoid these if you have either a 1024x768 screen and/or ATI graphics):
suto become root.
- You must run bucts, flipping the register so that the value is high (1) (as explained before):
- It should have said Updated BUC.TS=1 for the above command. If not, please do NOT continue; get help.
- Flash Coreboot (run both of these commands, whichever works first):
sudo ./flashrom_lenovobios_sst -p internal -w coreboot.rom
sudo ./flashrom_lenovobios_macronix -p internal -w coreboot.rom
- This will take a while, and will spit out a few errors (since the upper 64KiB region of the flash is write-protected).
- Check to make sure that the errors match the following (example):
Reading old flash chip contents... done. Erasing and writing flash chip... spi_block_erase_20 failed during command execution at address 0x0 Reading current flash chip contents... done. Looking for another erase function. spi_block_erase_52 failed during command execution at address 0x0 Reading current flash chip contents... done. Looking for another erase function. Transaction error! spi_block_erase_d8 failed during command execution at address 0x1f0000 Reading current flash chip contents... done. Looking for another erase function. spi_chip_erase_60 failed during command execution Reading current flash chip contents... done. Looking for another erase function. spi_chip_erase_c7 failed during command execution Looking for another erase function. No usable erase functions left. FAILED! Uh oh. Erase/write failed. Checking if anything has changed. Reading current flash chip contents... done. Apparently at least some data has changed. Your flash chip is in an unknown state.
- If the errors are like that then, contrary to the error output, the image was flashed successfully.
- If they don't match, DO NOT TURN OFF YOUR LAPTOP; get help instead.
- Shut down the laptop (fully shut it down, as in, turn it off), and then boot it again in a few seconds. Your laptop will boot into Coreboot.
Install Coreboot (Second Flash)
Next, flash Coreboot a second time to overwrite the vendor BIOS.
suto become root.
- Enter the
./flashrom -p internal -w coreboot.rom
- This will successfully overwrite the entire flash chip with no errors, including the last 64k that were write protected with the factory BIOS.
- If it complains about 3 different flashchips (in the case of macronix chip), do this instead:
./flashrom -p internal -w coreboot.rom -c "MX25L1605D/MX25L1608D/MX25L1673E"
- Reboot the laptop. Coreboot has been successfully installed.
Recovery with a Hardware Firmware Flasher
If you had a bad flash you will need to use a hardware flasher to reflash the BIOS.
If you want something that's easy to follow, the libreboot project shows how to flash externally using a BeagleBone Black
0. wire the pomona clip to a programmer that way:
From the #coreboot IRC Channel on FreeNode servers:
Oct 01 15:35:48 <CareBear\> one important thing is that when you connect the clip to the X60 you should not connect all pins [...] Oct 01 15:36:22 <CareBear\> only connect these pins: 1, 2, 4, 5, 6 [...] Oct 01 15:37:21 <CareBear\> also important: first connect charger to laptop, then connect the clip [...] Oct 01 17:49:41 <CareBear\> GNUtoo-desktop : the mainboard must be powered off, but with the charger connected [...] Oct 01 17:50:39 <CareBear\> um, that way there is no way anything will break [...] Oct 01 17:51:00 <CareBear\> it is important not to connect 3v3 from the outside Oct 01 17:51:39 <CareBear\> because the correct power sequencing is not known, and if any other rail must come on before the standby 3v3 then the machine may well break when 3v3 is applied from the outside [...] Oct 01 17:52:48 <CareBear\> it may also be fine - but it is unknown what happens [...] Oct 01 17:53:47 <CareBear\> not supplying 3v3 from the outside is safer Oct 01 17:54:25 <CareBear\> and because the machine is powered off, there is no risk of the chipset accessing the flash chip
In another hand I didn't follow that and wired it without powering the mainboard(mainboard disconnected from power plug, no battery in) and with all pins and it worked...
- Disassemble carefully the laptop, the SO-8 chip is on the bottom of the mainboard...
- connect the pomona clip to the flash chip
- flash coreboot or the BIOS
- remount the laptop
See also In-System Programming
Coreboot standard configuration
- It's now the default that when running SeaBios, that it (instead of coreboot) runs the VGA option rom.
See VGA_support for details on how to include the VGA BIOS image.
VBIOS replacement (native graphics)
The VGA option ROM (see above) is proprietary. Under devices in menuconfig, disable loading option ROM,s and enable 'Native graphics initialization'. Use the GRUB payload.
TODO: add notes here for how to patch coreboot for T60 native graphics (it's in libreboot already, or on 5345 on coreboot gerrit).