"articleBody": "Why would you flash Coreboot? There are several reasons why you should consider doing this. The BIOS1 on those Laptops is quite restrictive. You’re limited to 3 rather old WiFi card models, which only support 802.11n and are rather slow by today’s standards. If you try a non-whitelisted card it will refuse to boot until you remove the card. Also, there are no updates released by Lenovo to mitigate several exploits to the Intel ME. Another good point would be that you don’t know what the BIOS is doing in the background, it could send data home. Coreboot replaces the bios and therefore solves most of these issues. There is a python script to solve the Intel ME problem.\n Before you start Please make sure that you understand the following things before you start. It could be a major pain to brick your device or having to uninstall the mod later on.\nEC modding As far as I know, it’s not possible to flash the embedded controller without the original firmware/bios. So please apply any EC mods before you replace your bios. Here are some things which require EC modification, which you should really consider doing first. Thanks to Hamish Coleman it’s rather easy. Visit his project on GitHub!\n classic keyboard mod battery whitelist removal Don’t turn your device into an expensive paperweight Just to make it clear. You’re likely to turn your Thinkpad into a brick trying to swap the bios chip. Please remember that removing the chip is not necessary if you don’t suck at soldering and manage to solder wires to the chip. I still recommend replacing the chip, though. You can skip the whole desoldering and resoldering part if your chip already is a SOIC8 package.\n List of parts During the series, I will use the following tools:\n Disassembly Size 1Phillips screwdriver Chip removal Heat resistant tape Hot air station Flux Tweezers a 500°C tested working surface Reading and writing to the chip Chinese SOIC8 test clip Raspberry Pi2 flashrom — software to flash and read over SPI Some really tiny copper cables and some jumper wires soldering iron Installing the new chip 25Q128FVSIG – 3V – SOIC8 Chip — to replace the BIOS chip 60W soldering iron flux and solder Optional Thermal paste — you’re disassembling the whole thing, so why not reapply some fresh paste to the CPU? Disassembling the Thinkpad For a detailed guide on how to disassemble it, you can and should look into the official maintenance manual from Lenovo.\nProtip: Take pictures of screw placements and antenna cable routing.\nWhat I tried before removing the chip The first thing I tried was to solder way too big wires to the exposed little solder blobs. Thereby, I destroyed the solder blobs and now the board is throwing CMOS errors upon boot. I probably should’ve unplugged the CMOS battery. It still measures 3.10V though, which was slightly worrying as I thought I had damaged the board. As it turns out I didn’t. Still, it was not a smart idea, so disconnect your CMOS battery before soldering\nAlso, the bios didn’t boot after I reassembled the Laptop. Reheating the “destroyed” joints seems to have fixed this. Meaning that the BIOS chip was not broken at this point. So I finally decided to remove it from the board. As I didn’t have a heat gun at the time, I finally ordered one.\nPreparing the board We will heat the board up quite massively, as the WSON chip is connected to the big ground plains via a rather big pad under the chip. There are really small components around our chip which would be desoldered long before the chip if we heat them up. Also, as we don’t want them flying around, we’ll tape them off with our heat resistant tape. I used Kapton-Tape for this, which is not optimal as it is only made to withstand up to 280°C. If you have access to actual heat shielding tape made of aluminium or another metal, go for it. Just make sure to take your time and fit it tightly to the board. In my personal experience, the Kapton-tape is good enough that you don’t even desolder the small components.
<ahref="#dont-turn-your-device-into-an-expensive-paperweight"aria-label="Don&rsquo;t turn your device into an expensive paperweight">Don’t turn your device into an expensive paperweight</a></li><li>
<ahref="#list-of-parts"aria-label="List of parts">List of parts</a></li></ul>
</li><li>
<ahref="#disassembling-the-thinkpad"aria-label="Disassembling the Thinkpad">Disassembling the Thinkpad</a><ul>
<li>
<ahref="#what-i-tried-before-removing-the-chip"aria-label="What I tried before removing the chip">What I tried before removing the chip</a></li></ul>
</li><li>
<ahref="#preparing-the-board"aria-label="Preparing the board">Preparing the board</a></li><li>
<ahref="#desoldering-the-chip"aria-label="Desoldering the chip">Desoldering the chip</a></li><li>
<ahref="#soldering-the-new-chip"aria-label="Soldering the new chip">Soldering the new chip</a></li><li>
<ahref="#extracting-the-original-firmware"aria-label="Extracting the original firmware">Extracting the original firmware</a><ul>
<li>
<ahref="#wiring-the-chip-to-the-pi"aria-label="Wiring the chip to the Pi">Wiring the chip to the Pi</a></li><li>
<ahref="#creating-a-coreboot-image"aria-label="Creating a Coreboot image">Creating a Coreboot image</a></li></ul>
</div>
</details>
</div>
<divclass="post-content">
<h2id="why-would-you-flash-coreboot">Why would you flash Coreboot?<ahiddenclass="anchor"aria-hidden="true"href="#why-would-you-flash-coreboot">#</a></h2>
<p>There are several reasons why you should consider doing this. The
BIOS<supid="fnref:1"><ahref="#fn:1"class="footnote-ref"role="doc-noteref">1</a></sup> on those Laptops is quite restrictive. You’re
limited to 3 rather old WiFi card models, which only support 802.11n and
are rather slow by today’s standards. If you try a non-whitelisted card
it will refuse to boot until you remove the card. Also, there are no
updates released by Lenovo to mitigate several exploits to the Intel ME.
Another good point would be that you don’t know what the BIOS is doing
in the background, it could send data home. Coreboot replaces the bios
and therefore solves most of these issues. There is a <ahref="https://github.com/corna/me_cleaner">python
script</a> to solve the Intel ME
problem.</p>
<hr>
<h2id="before-you-start">Before you start<ahiddenclass="anchor"aria-hidden="true"href="#before-you-start">#</a></h2>
<p>Please make sure that you understand the following things before you
start. It could be a major pain to brick your device or having to
<h3id="dont-turn-your-device-into-an-expensive-paperweight">Don’t turn your device into an expensive paperweight<ahiddenclass="anchor"aria-hidden="true"href="#dont-turn-your-device-into-an-expensive-paperweight">#</a></h3>
<p>Just to make it clear. <strong>You’re likely to turn your Thinkpad into a
brick</strong> trying to swap the bios chip. Please remember that removing the
chip is not necessary if you <ahref="https://www.reddit.com/r/thinkpad/comments/7ce1q1/installing_coreboot_on_the_t430s_in_preparation/">don’t suck at
soldering</a>
and manage to solder wires to the chip. I still recommend replacing the
chip, though. You can skip the whole desoldering and resoldering part if
your chip already is a SOIC8 package.</p>
<hr>
<h3id="list-of-parts">List of parts<ahiddenclass="anchor"aria-hidden="true"href="#list-of-parts">#</a></h3>
<p>During the series, I will use the following tools:</p>
<li>flashrom — software to flash and read over SPI</li>
<li>Some really tiny copper cables and some jumper wires</li>
<li>soldering iron</li>
</ul>
</li>
<li>Installing the new chip
<ul>
<li>25Q128FVSIG – 3V – SOIC8 Chip — to replace the BIOS chip</li>
<li>60W soldering iron</li>
<li>flux and solder</li>
</ul>
</li>
<li>Optional
<ul>
<li>Thermal paste — you’re disassembling the whole thing, so why
not reapply some fresh paste to the CPU?</li>
</ul>
</li>
</ul>
<hr>
<h2id="disassembling-the-thinkpad">Disassembling the Thinkpad<ahiddenclass="anchor"aria-hidden="true"href="#disassembling-the-thinkpad">#</a></h2>
<p>For a detailed guide on how to disassemble it, you can and should look
into the <ahref="https://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles_pdf/0b48538.pdf">official maintenance
manual</a>
from Lenovo.</p>
<p>Protip: Take pictures of screw placements and antenna cable routing.</p>
<h3id="what-i-tried-before-removing-the-chip">What I tried before removing the chip<ahiddenclass="anchor"aria-hidden="true"href="#what-i-tried-before-removing-the-chip">#</a></h3>
<p>The first thing I tried was to solder way too big wires to the exposed
little solder blobs. Thereby, I destroyed the solder blobs and now the
board is throwing CMOS errors upon boot. I probably should’ve unplugged
the CMOS battery. It still measures 3.10V though, which was slightly
worrying as I thought I had damaged the board. As it turns out I didn’t.
Still, it was not a smart idea, so <em>disconnect your CMOS battery before
soldering</em></p>
<p><imgsrc="/images/Multimeter-192x300.jpg#center"alt="The voltage measurement of CMOS-Battery"></p>
<p>Also, the bios didn’t boot after I reassembled the Laptop. Reheating the
“destroyed” joints seems to have fixed this. Meaning that the BIOS chip
was not broken at this point. So I finally decided to remove it from the
board. As I didn’t have a heat gun at the time, I finally ordered one.</p>
<p></p>
<h2id="preparing-the-board">Preparing the board<ahiddenclass="anchor"aria-hidden="true"href="#preparing-the-board">#</a></h2>
<p>We will heat the board up quite massively, as the WSON chip is connected
to the big ground plains via a rather big pad under the chip. There are
really small components around our chip which would be desoldered long
before the chip if we heat them up. Also, as we don’t want them flying around, we’ll tape them
off with our heat resistant tape. I used Kapton-Tape for this, which is
not optimal as it is only made to withstand up to 280°C. If you have
access to actual heat shielding tape made of aluminium or another metal,
go for it. Just make sure to take your time and fit it tightly to the
board. In my personal experience, the Kapton-tape is good enough that
you don’t even desolder the small components. Well, at least they don’t move if they do and resolder fine.</p>
<p><imgsrc="/images/IMG_20180321_152222-e1522049347702-1024x579.jpg#center"alt="Board covered in Kapton tape – notice the dodgy solder balls around the chip"><br>
<em>Board covered in Kapton tape – notice the dodgy solder balls around the chip</em>
</p>
<h2id="desoldering-the-chip">Desoldering the chip<ahiddenclass="anchor"aria-hidden="true"href="#desoldering-the-chip">#</a></h2>
<p>Now that you have prepared the board it’s time to take your heat gun.
You cannot use a soldering iron as there is a large pad below the chip.
I set mine to around 350°C (~660°F) and a medium airflow. Make sure to
blow the air straight at the board and not at an angle to avoid
desoldering and blowing away those tiny resistors. Cycle over the chip
and use your tweezers to test if it came loose and finally remove the
chip. Even if you never used a heat gun before, it’s not that hard. Just
don’t pull on the chip while there is still solder holding it down.
Remove the Kapton-Tape from the board when you’re done unless you want
to use the heat gun to solder the replacement into place. Don’t throw
the old one away, we’ll need it later.</p>
<p><imgsrc="/images/desoldered-e1522272630299-1024x579.jpg#center"alt="The chip finally came off the board without lifting any pads. — the Kapton-Tape has darkened a bit.">
<em>The chip finally came off the board without lifting any pads. — the Kapton-Tape has darkened a bit.</em></p>
<h2id="soldering-the-new-chip">Soldering the new chip<ahiddenclass="anchor"aria-hidden="true"href="#soldering-the-new-chip">#</a></h2>
<p>Your replacement chip is a SOIC8 package. If you soldered SMD parts
before then you should have no problem. In case you haven’t: Make sure
you align the indent on the chip with the white mark on the board. The
indent tells you where PIN-1 is and the mark on the board shows you
where it should be soldered to. If there is still a rather big amount of
solder on the pads consider removing it using some solder wick. Align
the chip on the board and solder one pin to the board so it doesn’t move
anymore. Then take your time soldering the other seven.</p>
<p><imgsrc="/images/new-chip-e1522273951282-1024x579.jpg#center"alt="The new chip is soldered to the board, you can clearly see the alignment of the chip in the picture.">
<em>The new chip is soldered to the board, you can clearly see the alignment of the chip in the picture.</em></p>
<h2id="extracting-the-original-firmware">Extracting the original firmware<ahiddenclass="anchor"aria-hidden="true"href="#extracting-the-original-firmware">#</a></h2>
<p>At this point, we have a blank chip in our Thinkpad, so it won’t boot.
To fix this and to be able to prepare coreboot we need to extract the
original from the chip we desoldered. To achieve this I used a Raspberry
Pi, jumper wires and some really tiny copper wire. I cut one side of the
jumper wire off and attached the tiny copper wires. then I soldered
those to our old chip. To relieve stress I used the tape to hold it
down.</p>
<p><imgsrc="/images/soldered-wires-1-294x300.jpg#center"alt="Wires soldered to the chip, make sure you know where Pin 1 is before you tape it down. Later I spaced the wires on the left side out a bit more to prevent a short."><br>
<em>Wires soldered to the chip, make sure you know where Pin 1 is before you tape it down. Later I spaced the wires on the left side out a bit more to prevent a short.</em></p>
<hr>
<p>Now you have to setup your Raspberry Pi. You need to install flashrom
and enable SPI.</p>
<p>First install necessary tools and setup SPI</p>
flashrom v0.9.9-r1954 on Linux 4.9.80-v7+ <spanclass="o">(</span>armv7l<spanclass="o">)</span>
flashrom is free software, get the <spanclass="nb">source</span> code at https://flashrom.org
Calibrating delay loop... OK.
Found Winbond flash chip <spanclass="s2">"W25Q128.V"</span><spanclass="o">(</span><spanclass="m">16384</span> kB, SPI<spanclass="o">)</span> on linux_spi.
<p>Looks fine :) make sure to store one of those somewhere save! You’ll need
it if you ever want to update the Embedded Controller or don’t want
to use Coreboot anymore.</p>
<h2id="flashing-and-testing-our-new-chip">Flashing and testing our new chip<ahiddenclass="anchor"aria-hidden="true"href="#flashing-and-testing-our-new-chip">#</a></h2>
<p>Before we create a coreboot image, we’ll flash our original bios to our
new chip. This way we make sure that we soldered everything correctly
and our new chip works. First, you wire up your SOIC8-clip. The wiring
is the same as in the table above. Then you clip it onto the chip on the
board, make sure that there is no battery attached to the board!</p>
<p><imgsrc="/images/writing-the-new-chip-e1522281795259-1024x621.jpg#center"alt="The clip attached to the chip. Getting it to make a good connection can be hard the first times.">
</p>
<p>On our Raspberry Pi, we now verify that the chip gets recognized and
flashrom v0.9.9-r1954 on Linux 4.9.80-v7+ <spanclass="o">(</span>armv7l<spanclass="o">)</span>
flashrom is free software, get the <spanclass="nb">source</span> code at https://flashrom.org
Calibrating delay loop... OK.
Found Winbond flash chip <spanclass="s2">"W25Q128.V"</span><spanclass="o">(</span><spanclass="m">16384</span> kB, SPI<spanclass="o">)</span> on linux_spi.
</span>flashrom v0.9.9-r1954 on Linux 4.9.80-v7+ <spanclass="o">(</span>armv7l<spanclass="o">)</span>
flashrom is free software, get the <spanclass="nb">source</span> code at https://flashrom.org
Calibrating delay loop... OK.
Found Winbond flash chip <spanclass="s2">"W25Q128.V"</span><spanclass="o">(</span><spanclass="m">16384</span> kB, SPI<spanclass="o">)</span> on linux_spi.
Reading old flash chip contents... <spanclass="k">done</span>.
Erasing and writing flash chip... Erase/write <spanclass="k">done</span>.
<p>At this point, you connect a monitor via VGA or the display to the LVDS
connector, plug in the keyboard and connect the board to power. Try to
power on, if it shows you the Thinkpad logo everything works.
(Congrats!)</p>
<p>If the power LED just lights up shortly, try the following. Disconnect
power then press the power button for 1 second then release for one
second. Repeat this 10 times, then keep it pressed for 30s. Now plug the
cord back in and try booting again. If it still doesn’t work check your
solder joints. Sounds stupid, but worked for me.</p>
<p></p>
<h2id="creating-a-coreboot-image">Creating a Coreboot image<ahiddenclass="anchor"aria-hidden="true"href="#creating-a-coreboot-image">#</a></h2>
<p><!-- raw HTML omitted -->I’ll show you how to do this in Part 2, which I just released.<!-- raw HTML omitted --><br>
<em>The 2nd part will not be copied over to this blog as it was never really completed.
There has always been some discrepancies I don’t feel comfortable with. If you need help
setting up coreboot write a message below, or use the contact buttons to the right.</em></p>
<sectionclass="footnotes"role="doc-endnotes">
<hr>
<ol>
<liid="fn:1"role="doc-endnote">
<p>I know it’s actually UEFI based, but I’ll keep calling it BIOS as the search term is more common. <ahref="#fnref:1"class="footnote-backref"role="doc-backlink">↩︎</a></p>
<p>You can use any other SPI programmer which is supported by flashrom, or even write your own program and use unsupported programmers. The protocol is not that complex. <ahref="#fnref:2"class="footnote-backref"role="doc-backlink">↩︎</a></p>
