X330 BIOS

Background

IMPORTANT: ALWAYS DO A FULL BACKUP BEFORE DOING ANYTHING

This article isn’t written to replicate the other useful guides, but rather supplement the other numerous guides available. There are 2 sections to this guide, one for stock BIOS modifications and another for Coreboot compilation.

Please refer to the following resources and information for a general idea on how to do things.

• What is BIOS
• What is EEPROM
• What is the CH341a
• What is BIOS modding
• IFD unlock and layout of a BIOS image
• X230 Coreboot installation
• Skulls Coreboot repository
• My repository of compiled X230 BIOS modding information
• Coreboot compilation

Prerequisite

• CH341a or equivalent EEPROM SPI flasher
• flashrom
• uefitool

General Information

Refer to the skulls page for some basic idea on hardware flashing, specifically under the CH341a section. Refer to the X230 coreboot installation for some idea on how to use the CH341a. All commands and procedures will be using CH341a but any SPI EEPROM reader/flasher should work.

For most users who just want to patch their X230, look under patched images for flashing.

Flashing Methods

CH341a Hardware Flasher

There are a few variants of this flasher available, but the ones that are shipped from this website are the 3.3v variants. Most EEPROM (BIOS chip) operates at 3.3v and there is no need to modify it to flash the X230.

• Refer to this repo for more info.
• Use flashrom for advanced users and Linux users.
• Refer to this for a quick start guide on how to use the CH341a on Windows.
• The X230 coreboot guide also has a section on how to use the CH341a. Do not modify the flasher as it is already in 3.3v mode.

In short, clip the CH341a after shutting down the machine and run the programme (or flashrom). No other steps needed to flash the X330.

1vyrain

1vyrain is a software method for flashing the BIOS region on the X230 on stock BIOS. It’s fairly complicated but is extremely useful for those who do not have access to a hardware flasher. Once the machine is on stock BIOS v2.60, it can jump to any BIOS, even coreboot. This enables a software method to automatically install coreboot on the X230. This does not enable the lower 8MB region to be written to and will not disable Intel ME.

Stock BIOS

• A conventional BIOS image actually contains many parts.
• Stock BIOS is concatenated (joined) together by the top 4MB EEPROM BIOS chip and the bottom 8MB EEPROM BIOS chip.
• The actual BIOS portion we are concerned with is in the top 4MB chip while the 8MB chip contains the IFD, ME, Gbe regions.
• The 8MB region is untouched during stock Lenovo updates and should not be modified (see below).
• The top 4MB BIOS region is not unique to the laptop and can be extracted from Lenovo update images.

List of patches available

• 1vyrain patches (Whitelist removal, advanced menu unlock, 0x194 unlock/OC enable test)
• LVDS removal (To remove stock LVDS display in Windows for X330)
• VBT UEFI patch (To remove stock LVDS display in UEFI Linux OS)

Patched images for flashing

The stock 4MB BIOS top chip patched dump is available from my repository and downloadable below. Refer to Lenovo’s website for detailed changelog between versions.

• v2.60: Compatible with 1vyrain, highly recommended (SHA256)
• v2.72: Last version before spectre and meltdown (SHA256)
• v2.77: Latest X230 BIOS version (SHA256)

Quick hardware flashing guide

1. Flash any modified EC before doing any BIOS modifications.
2. Download the 4MB binary file.
3. Connect the clip to the top chip as shown here.
4. Backup the stock BIOS: sudo flashrom -p ch341a_spi -c MX25L3206E/MX25L3208E -r backup_top.bin.
5. Flash the downloaded patched BIOS: sudo flashrom -p ch341a_spi -c MX25L3206E/MX25L3208E -w patched_top.bin.

1vyrain flashing guide

1. Flash any modified EC before doing any BIOS modifications.
2. Follow all the instructions here.
3. Plug in the LAN cable.
4. Setup a temporary FTP local server on your computer to host the BIOS
5. Point 1vyrain to the hosted file FTP URL.

Detailed guide

Required steps

1. Flash any modified EC before doing any BIOS modifications.
2. Hardware dump (extract) stock BIOS (4MB) from your machine.
3. Patch stock BIOS with UEFIPatch.
4. Replace stock VBT with patched VBT.
5. Sign firmware with thinkpad-uefi-sign.
6. Hardware flash firmware back into EEPROM.

Optional steps

• Use your choice of BIOS version instead of dumped BIOS.
  • Extract any factory update ISO
  • Find the .FL1 file and run this command: dd if=BIOS.FL1 bs=1 of=BIOS.rom skip=464 count=4194304
• IFD unlock the lower 8MB chip so you can internally flash any firmware. (Stock BIOS will have trouble booting up, do not attempt this unless you know what you are doing)
• Clean Intel ME from the lower 8MB chip. (Stock BIOS will be unable to enter F1 setup)

Patching

1. Download the patch .txt file
2. Run this command on either the 4MB top BIOS binary or the full 12MB BIOS: uefipatch bios.bin patch.txt -o patched_bios.bin

VBT patching

From my understanding, the VBT is used for libgfxinit in coreboot and is used in place of VGA BIOS in UEFI BIOS. The LVDS patch only patches the CSM (BIOS) mode of the BIOS, not the UEFI portion. As such, some Linux distros (and other non-Windows) still sees the internal LVDS interface and shows 2 displays. By patching the VBT in UEFI, it will disable the LVDS stock panel as well.

1. Download uefitools.
2. Open firmware that you want to replace the VBT with (any 4MB/12MB dumped/stock ROM will do).
3. Search (Ctrl+F) for vbt, uncheck unicode.
4. Find all the VBT (usually last 2) in messages window which are 10BDh (4285) in size.
5. Right click and replace body with patched VBT.
6. Save new image file.
7. Clone think-uefi-sign: git clone https://github.com/thrimbor/thinkpad-uefi-sign.git
8. Sign the patched BIOS: ./sign.py input_image.bin -o signed_image.bin
9. Flash.

Coreboot

The X330 makes use of the X230 coreboot and changes the display settings. The FHD patch can be cherry-picked into the coreboot repo.

1. Clone coreboot: git clone --recurse-submodules https://review.coreboot.org/coreboot.git
2. cd into coreboot directory: cd coreboot
3. Cherry pick the patch: git fetch https://review.coreboot.org/coreboot refs/changes/50/28950/12 && git cherry-pick FETCH_HEAD
4. Copy and follow the instructions in my repo.
5. Follow the rest of the X230 coreboot guide for full compilation and flashing.

The provided settings uses tianocore which only supports UEFI OS. To adjust settings, run make nconfig.

The patched VBT enables proper Windows compatibility, replacing the wrongly patched VBT in the original patch. Once the original patch is fixed, copying the files will not be necessary.

Optional settings

Edit the payload to seabios for a traditional MBR style boot. Change the devices > display resolution for a different boot resolution. Default is set to 1366*768 for best compatibility.

To edit boot splash, follow this instruction and use this website to convert the image.

Adjust the size of CBFS (coreboot) to a larger size to make use of the full 12MB space in mainboard > size of CBFS filesystem in ROM. Default settings is 4MB which constraints CBFS to the top chip only. Using the default 1MB for tianocore may be too small and there will be compilation errors.