Flashing coreboot on ThinkPad T530/W530 without complete disassembly

The ThinkPad T530/W530 boards have two flash chips of 8M and 4M. In order to flash coreboot, you usually need to flash the 4M one. While on X230 it's very easy to access both chips by only removing keyboard and palmrest, it is not so on T530/W530 (on these models you can easily access 8M chip while the 4M stays covered by the magnesium frame).

There is a way to use only the 8M chip. It is convenient when you're coreboot developer and switching frequently between vendor BIOS and coreboot or just need to flash it externally and don't want to waste time by disassembling/reassembling it completely. Other use case is if you e.g. somehow broke the 4M chip.

To do that, you need to edit the bios region in flash descriptor so that the bios region would not exceed the 8M.

Dump the 8M chip with flashrom:

# flashrom -p <YOUR_SPI_PROGRAMMER> -r 8M.bin

Then extract layout to a file:

$ ifdtool -f layout.txt 8M.bin

See what's inside:

$ cat layout.txt 
00000000:00000fff fd
00500000:00bfffff bios
00003000:004fffff me
00001000:00002fff gbe

Edit the bios region, make it 00500000:007fffff, save the file.

Then update the layout in the dump. Unfortunately, ifdtool will segfault if you try to update your 8M.bin dump, because it expects 12M file, so let's make it 12M first:

$ dd if=/dev/zero of=4M.bin bs=1M count=4
$ cat 8M.bin 4M.bin > 12M.bin

And finally:

$ ifdtool -n layout.txt 12M.bin

In the end of the output you should see: Writing new image to 12M.bin.new. The size of resulting 12M.bin.new file will actually be 8M, because ifdtool truncates it according to layout.

Extract the fd modules:

$ ifdtool -x 12M.bin.new 
File 12M.bin.new is 8388608 bytes
  Flash Region 0 (Flash Descriptor): 00000000 - 00000fff 
  Flash Region 1 (BIOS): 00500000 - 007fffff 
  Flash Region 2 (Intel ME): 00003000 - 004fffff 
  Flash Region 3 (GbE): 00001000 - 00002fff 
  Flash Region 4 (Platform Data): 00fff000 - 00000fff (unused)

As you can see 4 new files were created:

$ ls flash*
flashregion_0_flashdescriptor.bin  flashregion_1_bios.bin  flashregion_2_intel_me.bin  flashregion_3_gbe.bin

Now you have to alter the coreboot config.

Mainboard --->
    ROM chip size (8192 KB (8MB))

Chipset --->
    [*] Add Intel descriptor.bin file
    (FD_PATH) Path and filename of the descriptor.bin file
    [*]   Add Intel ME/TXE firmware
    (ME_PATH) Path to management engine firmware
    [*] Add gigabit ethernet configuration
    (GBE_PATH) Path to gigabit ethernet configuration

Replace FD_PATH with full path to the flashregion_0_flashdescriptor.bin file generated in a previous step. Do the same for ME_PATH (flashregion_2_intel_me.bin) and GBE_PATH (flashregion_3_gbe.bin).

Build and flash the build/coreboot.rom to the 8M chip. Done.

If you have any comments, contact me by email.
Powered by OpenBSD
© ch1p 2019