Board:lenovo/x1 carbon gen1

Status

Intel_Native_Raminit has it's own status page.

Thanks for your interest in the Lenovo X1 Carbon 1st gen port. The X1 Carbon 1st gen is very similar to the Lenovo X230. See Board:lenovo/x230.

Issues

• Powered USB 2.0 port isn't powered in power-off state.
• S3 Suspend when resuming may cause black screen when not using a VGA option rom.
• SeaBIOS flickers when not using a VGA option rom.
• Bluetooth fails to load firmware. Unknown if related to coreboot.
• Keyboard backlight (fn + spacebar) has 4 modes instead of three. Two modes do not illuminate the keyboard (should be one), the remaining two modes illuminate the keyboard with low and high brightness as expected.

Tested

• S3 (Suspend to memory)
• S4 (Suspend to disk)
• USB (both 2.0 and 3.0 ports)
• ThinkPad USB 3.0 Ethernet Adapter (Device ID 17ef:7205)
• Video (internal)
• Sound (integrated speakers, integrated mic, external headphones)
• WLAN (Centrino Advanced-N 6205)
• WLAN toggle switch
• Linux Boot / Install (SeaBIOS)
• SD card reader (Ricoh Co Ltd PCIe SDXC/MMC Host Controller [1180:e823] (rev 07))
• Thermal management
• Fingerprint reader (147e:2020 Upek TouchChip Fingerprint Coprocessor)
• Webcam
• Trackpoint
• Touchpad
• Fn hotkeys
• Physical hotkeys (power, audio mute, mic mute, volume)
• Nvramcui as secondary payload
• Keyboard backlight
• Screen backlight
• mSATA

Untested

• Displayport
• External display (HDMI)
• WWAN

proprietary components status

• CPU Microcode
• VGA Option ROM (optional): you need it if you want graphics in SeaBIOS but most payloads should work without it (text mode or corebootfb mode)
• ME (Management Engine) => you do not have to touch it (just leave it where it is)
• EC (Embedded Controller) => you do not have to touch it (just leave it where it is)

Code

{{ #if: | * [{{{review_url}}} The code has been merged into coreboot master]: | * The code has been merged into coreboot master:}}

 $ git clone https://review.coreboot.org/coreboot.git

Please have a look at Build_HOWTO. Start compiling crossgcc right now! It will take a while. You will build coreboot itself at a later time.

Preparation

Required Tools

• External flash programmer. A CH341A flash programmer was used for this guide. You can find these for under $10.00.
• SOIC8 clip for externally reading and flashing. This eliminates the need for any soldering. You can find these for around $12.00.
• Secondary system with flashrom installed.

Update BIOS

It is a good idea to make sure you're on the latest firmware from Lenovo before flashing coreboot. This guide was written using the 2.75 bios.

• Bios Update CD Image
• Bios Update Windows Utility

Hardware Teardown

Proceeds as follows:

1. Turn off your laptop, remove AC adapter.
2. Detach the keyboard bezel assembly. You can keep the ribbon cable connected and pivot the keyboard assembly against the lid of the laptop.
3. Remove main battery conectoy and cmos battery connector.

It would be wise to install Linux and configure SSH before flashing coreboot to your X1 Carbon. This will allow you to troubleshoot from a running system if your display does not initialize after flashing.

Mainboard Flash Layout - MX25L3273E and MX25L6406E

The X1 Carbon 1st gen has 2 flash chips of 4M (MX25L3273E) and 8M (MX25L6406E). The flash chips are located just above the mSATA SSD. They're concatenated to one virtual flash chip of 12M which is itself subdivided in roughly in 3 parts:

• Descriptor (12K)
• ME firmware (5M-12K)
• System flash (7M)

ME firmware is not readable. Vendor firmware locks the flash and so you need to flash externally until you re-flash unlocked firmware.

When flashing coreboot you technically only need to flash the 4M MX25L3273E flash chip. You could follow this guide and flash coreboot without ever reading or writing to the 8M MX25L6406E, however you will need to read the 8M chip to extract the VGA BIOS.

• 

Lenovo Firmware Backup

Before building and flashing coreboot we need to make a copy of the existing firmware.

MX25L3273E Backup

Connect your SOIC clip to the MX25L3273E flash chip (the left one). Insert the CH341A flash programmer into a USB port. Read the stock firmware twice from the 4M MX25L3273E flash chip:

flashrom -p ch341a_spi -c MX25L3273E -r x1c_MX25L3273E_original_bios_1.bin
flashrom -p ch341a_spi -c MX25L3273E -r x1c_MX25L3273E_original_bios_2.bin

Compare the two images to ensure a successful read.

sha256sum x1c_MX25L3273E_original_bios_1.bin  x1c_MX25L3273E_original_bios_2.bin

sha256sum output:

b5bc2c096d53ed15fdbfe99c41bbb7ae9311366329cc19f611ba3f743c09b8e4  x1c_MX25L3273E_original_bios_1.bin 
b5bc2c096d53ed15fdbfe99c41bbb7ae9311366329cc19f611ba3f743c09b8e4  x1c_MX25L3273E_original_bios_2.bin

The hashes should match. If not, repeat the above steps. Your SOIC clip may require slight downward pressure during read and write operations. You'll need to get a feel for the clip. Some are made better than others.

Consolidate and rename your extracted firmware images (MX25L3273E)

rm x1c_MX25L3273E_original_bios_2.bin
mv x1c_MX25L3273E_original_bios_1.bin x1c_MX25L3273E_original_bios.bin

MX25L6406E Backup

Connect your SOIC clip to the MX25L6406E flash chip (the right one). Insert the CH341A flash programmer into a USB port. Read the stock firmware two separate times from the 8M MX25L6406E flash chip:

flashrom -p ch341a_spi -c "MX25L6406E/MX25L6408E" -r x1c_MX25L6406E_original_bios1.bin
flashrom -p ch341a_spi -c "MX25L6406E/MX25L6408E" -r x1c_MX25L6406E_original_bios2.bin

Compare the two images to ensure a successful read.

sha256sum x1c_MX25L6406E_original_bios1.bin x1c_MX25L6406E_original_bios2.bin

sha256sum output:

affd1adb758e971650c81a495fff5c5cfd88a206e2da6cf81a1032835a5d52c7  x1c_MX25L6406E_original_bios1.bin
affd1adb758e971650c81a495fff5c5cfd88a206e2da6cf81a1032835a5d52c7  x1c_MX25L6406E_original_bios2.bin

The hashes should match. If not, repeat the above steps.

Consolidate and rename your extracted firmware images (MX25L6406E)

rm x1c_MX25L6406E_original_bios2.bin
mv x1c_MX25L6406E_original_bios1.bin x1c_MX25L6406E_original_bios.bin

12M Virtual Flash Image

After successfully extracting the firmware from both flash chips combine the 4M and 8M firmware images into the full 12M virtual flash image.

cat x1c_MX25L3273E_original_bios.bin x1c_MX25L6406E_original_bios.bin > x1c_original_bios.bin

Extract VGA BIOS - UEFITool

Use git to clone the UEFITool repository and build UEFITool. Requires qt5base-devel package in Ubuntu 16.04. See the included README.

git clone https://github.com/LongSoft/UEFITool.git
cd ./UEFITool

Build UEFITool

/usr/lib/x86_64-linux-gnu/qt5/bin/qmake /uefitool.pro
make release

Launch UEFITool

1. Open the 12M combined bios file (x1c_original_bios.bin) File -> Open image file…
2. Search for text "VGA Compatible BIOS" (uncheck unicode) File -> Search
3. Double click search the search result. This will highlight the raw section.
4. Right click highlighted raw section and select Extract Body.... Save the extracted file. This is your extracted vga bios - 'x1c_vga_bios.img'.

• 
• 
• 

Run sha256sum to calculate the checksum:

sha256sum x1c_vga_bios.img

Output:

2ffad3deec22bde663721c496de5792a0429f5732145f0782bb389dda3ac7ed6  x1c_vga_bios.img

We’ll come back to this vga bios file when it’s time to build coreboot.

Unlock and Re-Flash MX25L6406E

Unlocking the 8M MX25L6406E flash image allows you to use flashrom internally without resorting to the SOIC clip and external flash programmer. This is not a required step, merely recommended.

Build ifdtool.

cd ./coreboot/util/ifdtool
make

Use ifdtool to unlock the 8M bios image. Your paths may be slightly different.

./ifdtool -u ../x1c_MX25L6406E_original_bios.bin ../x1c_MX25L6406E_original_bios_unlocked.bin

Flash the unlocked 8M image back to the MX25L6406E

sudo flashrom -p ch341a_spi -c "MX25L6406E/MX25L6408E" -w x1c_MX25L6406E_original_bios_unlocked.bin

Building Firmware

Please have a look at Intel_Sandybridge_Build_Tutorial.

In the coreboot directory you can configure the build-time options of coreboot with

make nconfig

Recommended options:

General Setup

[*] Use CMOS for configuration values
[*] Compress ramstage with LZMA
[*] Include the coreboot .config file into the ROM image 

Mainboard

Mainboard vendor (Lenovo)
Mainboard model (ThinkPad X1 carbon gen 1)
ROM chip size (12288 KB (12 MB))
(0x100000) Size of CBFS filesystem in ROM

Chipset

[*] Enable VMX for virtualization 
[*]   Set lock bit after configuring VMX
[*]   Build with a fake IFD

Devices

[ ] Use native graphics initialization
[ ] Run VGA Option ROMs 
[*] Enable PCIe Clock Power Management
[*] Enable PCIe ASPM L1 SubState
[*] Add a VGA BIOS image
   (x1c_vga_bios.img) VGA BIOS path and filename
   (8086,0166) VGA device PCI IDs

Generic Drivers

[*] Support Intel PCI-e WiFi adapters
[*] PS/2 keyboard init

Console (Defaults)

[*] Squelch AP CPUs from early console.
[*] Send console output to a CBMEM buffer
(0x20000) Room allocated for console output in CBMEM
[*] Send POST codes to an external device
[*] Send POST codes to an IO port
(0x80)IO port for POST codes 

System Tables

[*] Generate SMBIOS tables   

Payload

Add a payload (SeaBIOS)
   SeaBIOS version (master)
   (10) PS/2 keyboard controller initialization timeout (milliseconds)
[*] Use LZMA compression for payloads
   Secondary Payloads--->
      [*] Load nvramcui as a secondary payload

Recommended '.config' file available here with the above configuratoin (SeaBios, nvramcui, VGA BIOS image).

Build coreboot rom

make

The coreboot rom is saved to ./build/coreboot.rom.

Flashing Coreboot

First we need to split the coreboot.rom file. Remember, you only need to flash coreboot to the 4M MX25L3273E (left) flash chip. Since you have to write only top 4M, split the file with dd:

dd of=./x1_carbon_MX25L3273E_coreboot.rom bs=1M if=./build/coreboot.rom skip=8

Connect your SOIC clip to the MX25L3273E flash chip (the left one). Insert the CH341A flash programmer into a USB port. Flash the 4M coreboot rom:

flashrom -p ch341a_spi -c MX25L3273E -w ./x1_carbon_MX25L3273E_coreboot.rom

Congrats! You can now boot your X1 Carbon from coreboot!

If you're successful you will be greated by SeaBIOS (or your preferred payload).

• 

Internal Flashing

flashrom -p internal:laptop=force_I_want_a_brick -l ./x1c.layout -i bios -w ./build/coreboot.rom