1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
|
+++
title = "Liberating my X200"
date = 2022-10-23T23:56:42
+++
I had wanted to libreboot my trusty old Thinkpad X200 for quite sometime. Only
recently did I get around to librebooting mine. Even though the information on
how to do it is out there and quite good, some of it is spread throughout the
internet and didn't all completely apply to my particular case, hence I decided
to write this post on how I went about flashing Libreboot on my X200.
<!-- more -->
I had been wanting to flash Libreboot on my X200 ever since I got it, but only
recently did I get around actually doing it. The process isn't hard at all, you
don't need any special skills besides knowing how to use the Linux command line
and not being afraid to open your laptop and connecting some wires to it.
There's many reasons to want to install Libreboot or Coreboot, some which are
faster boot times, custom payloads, and of course, muh freedumbs. I was mainly
looking for faster boot times and having an almost completely free and open
source laptop without backdoors, i.e. Intel ME[^1].
For this I used a CH341A programmer. Yes, the official Libreboot site[^2] warns
against using it, but really it just because of a batch of faulty boards that
deliver 5V instead of 3.3V on the 3.3V pin. That said, if you have a multimeter
lying around it quite easy to make sure that you have a proper CH341A with 3.3V
DC instead of 5V. After plugging my multimeter I found that mine was fine and so
I proceeded to use to flash my laptop.
Most Thinkpads out there have 16 pin SPI chip, and that's why most information
out there is about them, but mine had an 8 pin. In my case that was better for
me, since the CH341A I bought came with a SOIC8 clip, so I didn't have to buy
a separate clip. I did end up desoldering the cables that came attached to the
clip since I wanted to use jumper female-female cables to connect the clip to
the CH341A.
[](libreboot-01.jpg)
<figcaption>
Unsoldered SOIC8 clip next to the CH341A with jumper cables already connected to
the board.
</figcaption>
After unsoldering the clip, I went ahead and opened my laptop. It's only
necessary to remove the keyboard and palmrest to get access to the chip.
Removing the keyboard and palmrest assembly is really easy. The only thing that
you need to do is unscrew 8 phillip-head screws which are marked with the
palmrest and the keyboard icons, the push the keyboard towards the screen pull
it up, disconnect it and next lift off the palmrest. You might need to also
disconnect the fingerprint reader if you have one, mine doesn't so I didn't have
to. Also, don't forget to remove the laptop battery and disconnect the CMOS
battery.
[](libreboot-02.jpg)
<figcaption>
Removing the keyboard and palmrest.
</figcaption>
After getting the keyboard and palmrest out of the way, there was the chip. All
of those chips have a dot indicating pin 1. It's important to locate pin 1 in
order to know how to properly connect the pins to the flashing board. The
scheme is as follows:
Wire all of the pins on the chip to the following pins on the CH341A:
1. CS
2. MISO/MIOS
3. _unused_
4. GND
5. MOSI
6. CLK
7. _unused_
8. 3.3V
After wiring up properly the clip to the CH341A, I proceeded to secure the clip
to the chip by making sure that pin 1 was correctly wired to CS on the CH341A.
Then, after making sure that the clip was properly and securely in place, I
proceeded to connect the CH341A to the host computer from which I would be
flashing. **It's very important to first connect the clip and then the board to
the host, otherwise you risk frying your chip and bricking your laptop!**
[](libreboot-03.jpg)
<figcaption>
CH341A connected to the chip and host computer.
</figcaption>
For reading and flashing SPI chips, a program called flashrom is needed, which
is available in most distributions' repos.
After I checked dmesg to see that the CH341A properly recognized by the host, I
went ahead and proceeded to dump the original firmware. I did this twice to run
a diff on both dumps and make sure that I was getting correct readings before
actually flashing the Libreboot image:
```
# flashrom -p ch341a_spi -r bak1.rom
...
# flashrom -p ch341a_spi -r bak2.rom
...
# diff bak1.rom bak2.rom
```
I got an empty output from diff, which means that the two reads were
identically, and so I could continue with more confidence that I wouldn't brick
my laptop. Also, from the output, I could gather that my chip was a 4mb one, so
the image that I downloaded was the 20220710 4mb release for the X200. All
Libreboot images can be downloaded from here:
<https://libreboot.org/download.html>.
I chose to install the one with grub as first payload and SeaBios as secondary
since I only use Linux. After choosing and downloading the image I proceeded to
flash it:
```
# flashrom -p ch341a_spi -w grub_x200_4mb_libgfxinit_corebootfb_usqwerty.rom
```
After a couple of minutes of flashing it was done. I was now able to fully enjoy
muh freedumbs. I assembled back the computer and booted it up and there it was,
the libreboot grub menu greeting me.
Everything was fine until the computer froze, I rebooted it and was greeted by
some weird noise on the screen and nothing else. I fiddled around, dumped the
chip to check it was correctly flashed (it was), tried different images, until
it dawned on me that I had two different RAM sticks on my X200, a 4GB one and a
2GB one. After removing the 2GB one everything went back to normal.
Libreboot/Coreboot does indeed boot much faster than the native firmware. It
even wakes up instantaneously from sleep, whereas with the native firmware it
would take 1-2s seconds to do so. I also noticed slightly better graphics
performance, which could be attributed to the bigger amount of RAM that is
dedicated to iGPU with Libreboot compared to the native firmware.
[](libreboot-04.jpg)
<figcaption>
Muh freedumbs!
</figcaption>
That's it, it really is that easy. After flashing Libreboot it is possible to
flash the SPI chip using software only without having to use an external
flasher. It's as simple as using the flashrom program, except that you use `-p
internal` to let know flashrom that you will be flashing the chip internally.
If you are interested in making any further modifications to your Libreboot
image, it's best to read the official Libreboot and possibly Coreboot resources.
If, for example, you want to change GRUB's background just as I did, you can
read more about it here: <https://libreboot.org/docs/gnulinux/grub_cbfs.html>.
[^1]: The Intel Management Engine is a secondary processor installed on all
Intel chips from circa 2007 onwards. It runs its own OS and environment and
has full control over the machine, furthermore it can't be officially disabled
by the user, and requires measures such as flashing custom firmware or even
soldering/desoldering certain components in order for it to be completely
neutered. It's a huge security risk, but unfortunately one can't be easily
mitigated and continues to be deployed like a virus in all modern x86
machines. Yes, AMD also has its own version of the ME called the PSP or
Platform Security Processor. Another reason why closed proprietary systems are
a bad thing for privacy, security and freedom.
[^2]: <https://libreboot.org/>
|
