Thinkpads Forum

Looking for something to do and was thinking about Coreboot. I have 2 T420 laptops I use daily (1 other in reserve). I bought the items necessary for Coreboot (Pomona SOIC8, CH341A and female to female header cables).

To my horror though it seems to get access to the T420 BIOS chip you have to strip the T420 down to the motherboard. I'm slightly hesitant about this. Anyone here know whether there's a good chance of permanently screwing the laptop up? Is it worth the risk for Coreboot? I've disassembled it before to change things like the keyboard or the fan/heatsink but never gone all the way.

Just looking for people's opinions please!

I have an X220 I definitely try and do since that's only a few screws that need to be removed.

If you are already hesitant to take a motherboard out of its frame, you should definitely stay away from the likes of Coreboot and Hackintosh.

My only advise would be to keep close track of which screw goes where upon reassembly. Take pictures, make notes. You don't want to strip out a screw hole or worse yet, have a screw penetrate the plastic because it was too long for where you inserted it.

VanZan wrote: ↑

Sat Jul 25, 2020 5:00 am

Anyone here know whether there's a good chance of permanently screwing the laptop up? Is it worth the risk for Coreboot?

Some system boards have been damaged during reassembly, when a screw that's too long is tightened, hits the system board, and shorts adjacent components. The end result is a blown motherboard when it's powered up. This is why MikalE mentions keeping close track of which screws go to which hole in the post above mine.

To me its not worth it on a t420.

The 420 has most of the current cpu security fixes and its slic and whitelisted. Its a lot more than I would expect from a decade old unit.

It does have ME right? That is a concern but really is it for most people.

And what o/s? Mine runs Win7 fine.

TonyJZX wrote: ↑

Tue Jul 28, 2020 12:10 pm

To me its not worth it on a t420.

The 420 has most of the current cpu security fixes and its slic and whitelisted. Its a lot more than I would expect from a decade old unit.

It does have ME right? That is a concern but really is it for most people.

And what o/s? Mine runs Win7 fine.

Coreboot does allow upgrading to Ivy Bridge CPUs, if that's what OP is looking for

Hello,
I just flashed my T420 (which I use since years) with a self-built coreboot ROM image last week. After the expreience I made for now can only recommend it!

Be aware that in my case all I expected was a "clean" ROM being able to boot my Linux OS, and I got exactly this
So nothing more (in fact, the SeaBios I currently use as coreboot payload does not come with a extensive "configuration menu" or something you might be used to from other bioses, but simply prints out a boot menu, if you press ESC).


Regarding the (dis-)assembly
My advice would be to follow exactly the steps illustrated in the Thinkpad Hardware Manual. I put the screws of each step in separate small plastic bags (the ones you can close). You can also print out the respective images where the steps are illustrated (should be < 10 pages) and tie the plastic bags to these pages. This would have been better for me, as at one step I first got the wrong plastic bag, but I found it out soon, comparing the length of the screws with the length mentioned in the manual.

Regarding the build
I selected the mainboard type T420 and selected "high resolution framebuffer" in the Display section. In this way the password screen for disk encryption on Ubuntu is shown correctly, also when an external monitor is connected (with legacy VGA, the screen might be shown only on one screen, while the other screen will not be usable for this boot).
I experimented with a boot bootsplash logo, but came to the conclusion to leave it up (proprietary VGA-bios blob required, otherwise logo is shown with artifacts). The bootsplash is displayed only for the delay you wait when the boot menu is shown. I minimized this delay to 200ms, so I would not have seen much of the image anyways.
You can disable the ME directly in the coreboot build. This worked for me. However, after positive experiments with that, I went on and used me_cleaner.py to reduce the size of the ME from 5MB to 84kB.
It will run the board Bring-Up (BUP) and then go to the "disabled" state, as usual with the Alt-ME Bit being set. The ME kernel is not running, because the part required to run is not there anymore
So the TCP stack and everything ME would need for network access is simply patched out completely.

btw: on the free space on the SPI chip, you could also store a small Linux kernel to boot your kernel, instead of using SeaBios. I did not try it for now, but I freed up the ~6 MB where it could stay.

So the following proprietary blobs remain:

• me.bin (84kB)

• gbe.bin (gigabit network adaptor initialization)

If I did not forget a thing, all the rest should be built from open source components now.

Note: for SeaBios, I had to add a "bootorder" file to the ROM, as I use the mSata SSD option and otherwise I had to select the device at each boot.

Regarding the normal operation
As I mentioned, I use Linux. I did not see any noticeable difference/problems with coreboot. Some users mention that the power consumption would be higher / the board would heat up more quickly. I cannot confirm this for now. My fan is not hearable when browsing the web, etc. I use Suspend-to-Ram often when closing the lid (sometimes over months). Also this worked without problems for now.

Flashing
I used a RaspberryPi to flash the Chip with a Clamp connected to it. I read out the chip several times. For now, I only had to write to it once externally.
All the next flashing trials can be done internally with flashrom, when Linux is booted. In fact, I booted Linux from a USB Stick several times when the Mainboard laid on the table, with only the screen and the keyboard being connected to it. After I was satisfied with the coreboot rom, I reassembled the laptop and put my old disks back in again (mSata SSD + HDD), and the system worked just as before.

Note that if you have made a backup of your original ROM, you can always turn back to the state you had before.
Sou if you have decided to give coreboot a try and you have some questions, I would be glad to help you.

Some additional remarks:

• The docking station is also working fine (Type 4337). Was not on the list on the (old) T420 coreboot wiki page.

• For now I did not have any sporadic reboots or other strange behavior mentioned on the page.

• The original Intel WLAN adaptor works fine (although you could replace it by Atheros to avoid proprietary firmware on the card).

A (strange?) thing I came over when reading out the Flash Chip
Usually you read back the flash after writing to it (flashrom does this already when it prints out VERIFIED). When you compare the read-out image, it should be exactly the same. This is true if you do it directly after flashing.
However, if you reboot your system and you read out the chip again, you will be surprised. The image differs from the original one you flashed (at least on the T420).
In the original case, exactly 1600 bytes are written to the area beginning at offset 0x00700000. In this area (which according to the coreboot Wiki belongs to the ME), normally a large section is filled initially with 0xFF (so probably free space to store information).

Now in midst of these mentioned 1600 bytes in question, I found the following:
> 00700530: 0000 0500 dc05 0300 830b 4e54 3447 4336 ..........NT4GC6
> 00700540: 3442 3848 4730 4e53 2d43 0064 6623 0500 4B8HG0NS-C.df#..
If you google the string in it, you will find the 4G SODIMM-RAM module I used for this boot.

If you insert a different SODIMM module before the next bootup, another 1600 bytes section is appended after the first one, containing the type information of this new module. So this seems to be kind of a list of hardware information, regarding RAM modules. All the rest of the ROM image did not change in my current observations.
I have not found any hint in the documentation that the flashed image would change itself upon booting...

Now my question is:
Why is this RAM configuration information stored in the flash memory, and not in NVRAM???
I thought the flash memory should be read-only! (except for BIOS updates or some strange guy who flashes coreboot...)

Or am I wrong here? Maybe someone has a better understanding of this and can comment on it?
I would be very interested in the backgrounds!

hi therisc,

would you be willing to share your coreboot rom you built for your t420 with me? i build 3 roms so far and it did not work for me. not sure why (maybe missing vga bios) but i am sick of disassembling my pc one more time without success...

thanks!