X230 Coreboot and me

step 0 - prep work and tools

get a soldering iron and preferred desoldering stuff
get a USB SPI ROM programmer
- I used a SparkFun Bus Pirate circa 2010
  - be sure the firmware is updated to >5.4, or the read/write speeds will be intolerably slow (>3 hours)
get an 8pin SOIC chip clip (like this)
install flashrom
install git
clone me_cleaner
- git clone "https://github.com/corna/me_cleaner"
- requires python
clone Coreboot
- git clone --recurse-submodules "https://review.coreboot.org/coreboot.git"
- requires gcc, make, etc, bison, flex, gcc-ada

disassemble the laptop
- be sure to disconnect the main battery and the "CMOS" battery
desolder SPI1 and SPI2
- SOIC-8 chips
- on the board near where the touchpad was
- SPI1 is the first 8mb of the BIOS
  - MX25L6406E or similar (datasheet)
- SPI2 is the remaining 4mb of the BIOS
  - MX25L3206E or similar (datasheet)

dump SPI1
- flashrom --chip "MX25L6406E/MX25L6408E" --programmer buspirate_spi:dev=/dev/ttyUSB0 --read ./bios-8m.img
  - took about 22 minutes
dump SPI2
- flashrom --chip "MX25L3206E/MX25L3208E" --programmer buspirate_spi:dev=/dev/ttyUSB0 --read ./bios-4m.img
  - took about 11 minutes
join the dumps
- cat bios-8m.img bios-4m.img > bios-12m.img

check me_cleaner chipset status
- my X230 uses a Core i5-3320M, which is Ivy Bridge, which uses ME 8.x
  - me_cleaner can remove all modules except ROMP and BUP
  - optionally, me_cleaner can also set the MeAltDisable flag to disable ME entirely
check ME dump
1. build ifdtool
  1. cd coreboot/util/ifdtool
  2. make
2. ifdtool --dump bios-12m.img
run me_cleaner
1. cd me_cleaner
2. check ME again
  - python me_cleaner.py -c bios-12m.img
3. enable ME kill switch and clean ME
  - python me_cleaner.py -S -O bios-12m-cleaned.img bios-12m.img
unlock flash descriptor and ME region
1. ifdtool --unlock bios-12m-cleaned.img
2. mv bios-12m-cleaned.img.new bios-12m-cleaned-unlocked.img

extract blobs
- ifdtool --extract bios-12m-cleaned-unlocked.img creates these files:
  - flashregion_0_flashdescriptor.bin: flash image metadata
  - flashregion_1_bios.bin: OEM BIOS, to be replaced with Coreboot
  - flashregion_2_intel_me.bin: ME blob, changed by me_cleaner
  - flashregion_3_gbe.bin: built-in Ethernet card firmware, not using
configure Coreboot
1. cd coreboot
2. make distclean
3. make menuconfig
  - General setup --->
    - [*] Use CMOS for configuration values
  - Mainboard --->
    - Mainboard vendor --->
      - (X) Lenovo
    - Mainboard model --->
      - (X) ThinkPad X230
    - ROM chip size --->
      - (X) 12288 KB (12 MB)
        
        this should be selected by default
  - Chipset --->
    - [*] Add Intel descriptor.bin file
      - flashregion_0_flashdescriptor.bin
    - [*] Add Intel ME/TXE firmware
      - flashregion_2_intel_me.bin
  - Devices --->
    - Graphics initialization --->
      - (X) Use native graphics init
        
        should be selected by default?
        
        allows us to not need VGA option ROM (only for Intel mobile CPUs with LVDS screens)
  - <Save>
build Coreboot
1. make crossgcc-i386 CPUS=4
2. make crossgcc-x64 CPUS=4
3. make
4. cp build/coreboot.rom ../coreboot.img

dd bs=1M count=8 if=coreboot.img of=coreboot-8m.img
dd bs=1M skip=8 count=4 if=coreboot.img of=coreboot-4m.img
use ls -l to make sure coreboot-8m.img and coreboot-4m.img are the same size as bios-8m.img and bios-4m.img, respectively

write SPI1
- flashrom --chip "MX25L6406E/MX25L6408E" --programmer buspirate_spi:dev=/dev/ttyUSB0 --write coreboot-8m.img
  - took about 53 minutes
write SPI2
- flashrom --chip "MX25L3206E/MX25L3208E" --programmer buspirate_spi:dev=/dev/ttyUSB0 --write coreboot-4m.img
  - took about 31 minutes

re-solder flash ROMs, re-assemble laptop, and enjoy!