Coreboot
2019-07-03
Last time I wrote about libreboot updating, this time I'll write about the coreboot.
The difference between coreboot and libreboot is that the open-source coreboot may need some binary blobs to run properly on some devices, while libreboot embraces the GNU free-software philosophy and refuses to run anything proprietary. Needless to say, coreboot supports way more devices than libreboot. See the coreboot.org website for more info.
I was working with a ThinkPad X220, but the overall process is usually the same. You'll need some way to reprogram the SOIC chip with the firmware. On an X220 the firmware resides on a SOIC-8 chip to which you can connect with a SOIC clip like Pamona 5250 or similar. On the other end of the wire you connect a flasher, for example a RaspberryPi (that's what I used). Long story short: disassemble your laptop, find a proper chip on your motherboard, connect it with a clip to the RaspberryPi GPIO, then you can flash. The coreboot wiki will tell you where on your motherboard the chip is located. Don't get confused: "SOIC clip, SOIC flasher, SPI flasher, SPI programmer" are all just fancy words for the same, basically.
The best guide on how to do all this is: https://github.com/bibanon/Coreboot-ThinkPads/wiki/Hardware-Flashing-with-Raspberry-Pi
To check the GPIO pinout of your particular RaspberryPi:
$ pinout
A little dot on a SOIC chip indicates pin 1, refer to the github page I linked above.
For a SOIC-8, that's the connection you can use:
| pin | desc | RaspberryPi |
|---|
| 1 | CS | (24) GPIO08 |
| 2 | MISO | (21) GPIO09 |
| 3 | empty |
| 4 | GND | (20) GND |
| 5 | MOSI | (19) GPIO10 |
| 6 | CLK | (23) GPIO11 |
| 7 | empty |
| 8 | 3.3V | (17) 3.3 V |
You may clean the chip with alcohol before you start. It helps with connection and let's you visually check the exact version of your chip.
Make sure you've properly connected your clip. Use the latest flashrom.
$ git clone https://review.coreboot.org/flashrom.git && cd flashrom && make
You may have to modprobe some spi stuff. (don't quote me on this one)
$ modprobe spi-{bcm2835aux,gpio,nor}
I'm assuming you are using the RPi GPIO as your SPI programmer. To check the connection:
$ ./flashrom -p linux_spi:dev=/dev/spidev0.0 -V
The common misconception is that you shouldn't use AC power adapter when flashing, but the truth is some chips won't power up without it. Check it out if the flashrom wierdly doesn't cooperate. Again, refer to the github page I linked above.
If the connection was fine, you'll now have a list of chips your motherboard is likely using.
Confirm that with the print on the chip casing. Dump the rom image a few times (you can use different -c value) and compare SHA2 checksums. If they're matching, you're good to go.
$ ./flashrom -p linux_spi:dev=/dev/spidev0.0 -c [chip] -r test-01.img
$ ./flashrom -p linux_spi:dev=/dev/spidev0.0 -c [chip] -r test-02.img
...
$ sha256sum test-*.img
Note some informations about your chip, particularly the chip size:
$ ./flashrom -p linux_spi:dev=/dev/spidev0.0 -c [chip] -V
Take one of those dumps, it's your ROM backup now. We will extract binary blobs and deactivate Intel ME with a program called me_cleaner ( https://github.com/corna/me_cleaner ). You can copy that backup and do the rest on your main machine. We will come back to the RPi when we have a coreboot rom image done and ready to flash (NOT YET). We will flash with a following command:
$ ./flashrom -p linux_spi:dev=/dev/spidev0.0 -c [chip] -w [path/to/coreboot.rom]
Once you flash any coreboot image (unless explicitly set otherwise) you will be able to use the internal programmer and apply instructions from my "Libreboot updating" post in the future; for example to change the configuration.
Now, on how to build a coreboot image... Wiki and even the download page will tell you to build from git, but that's just bullshit - it won't compile. At least it wouldn't for me...
Instead, get the latest RELEASE from coreboot.org/downloads.html. Download both source and blobs, then merge folders and open up a terminal:
$ make menuconfig
$ make crossgcc-i386
Most important settings are as follows:
General setup:
Allow use of binary-only repository
Mainboard:
Vendor: Lenovo
Model: ThinkPad X220
ROM chip size: 8 MB (flashrom told you that)
Chipset:
Ignore vendor programmed fuses that limit max. DRAM frequency
Add Intel descriptor.bin file
Add Intel ME/TXE firmware
Generic Drivers:
PS/2 keyboard init
Payload:
(set anything you like, but make sure you'll be able to boot when you flash the rom image)
Now let's add the blobs and neutralize Managment Engine:
$ yaourt -S me_cleaner-git # installs me_cleaner
$ me_cleaner -Srtd [path/to/clean_rom.img] -D [descriptor.bin] -M [me.bin] -O [output_rom.img]
Place descriptor.bin and me.bin in your coreboot directory under 3rdparty/blobs/mainboard/[vendor]/[model]/ like so:
$ cp *.bin 3rdparty/blobs/mainboard/lenovo/x220/
This should be sufficient to start a system.
You might still want to add other blobs, though. For instance - Intel Gigabit Engine may be necessary for some boards to use the ethernet.
Build the final image:
$ make
The output is build/coreboot.rom in the coreboot directory.
Copy it over to your raspberry pi and finally flash!
$ ./flashrom -p linux_spi:dev=/dev/spidev0.0 -c [chip] -w [path/to/coreboot.rom]
If the program prints "VERIFIED", you can safely unplug the clip, assemble your machine and boot.
Rebuild coreboot as many times as you like, tweak and personalise to your heart's content.
Now, anytime you want to reflash coreboot, use the internal programmer - no need to disassemble your machine anymore!