[zn0]

I recently flashed coreboot on my Thinkpad x230, and wanted to document the procedure for you guys. I not only replaced the proprietary Lenovo BIOS with coreboot, but also neutered the IME (Intel Mangement Engine).

Why would you want to do this?
Let's back up for a minute and talk about why boot-time firmware security is important. When you buy a modern laptop there are lots of firmware that comes with it. Most of this software, if not all of it, is closed-source which means there is no way for you to know what it is doing.
Since the x86 firmware contains the initial instructions the CPU executes when it comes out of reset, it is important that it's protected against malicious modification. Since the firmware is able to talk directly to hardware that can bypass kernel checks, it is vital that bugs in the firmware are fixable. If the boot firmware is compromised or buggy, the rest of the system is built on an unstable foundation.

We know that malicious hackers and nation states are using firmware attacks against their targets, and once malware has taken root inside the firmware, it is very difficult to remove since it can hide inside of things like SMM and survive reinstallation of the OS and even replacement of the harddrive. In fact, some vendors even ship "rootkits" in their firmware that can reinstall itself into the OS and circumvent the OS's security policies, so even if you reformat the disk and get a fresh install the rootkit will reinstall itself. Vulnerabilities in the vendor supplied and replaceable code could be taken advantage of by malicious attackers as well. Unfortunately most firmwares are never updated since there are usually four or five companies between the UEFI source tree and your machine, which means that every party along the way needs to be motivated to QA a fix. This would be unacceptable for an operating system or application, which both receive frequent and rapid updates when vulnerabilities are found. The best way to defend against this is to replace your proprietary firmware with an open-source alternative that is properly audited and trusted. This of course doesn't eliminate the threat completely, but you can at least trust it a bit more compared to the closed-source vendor firmware.

I also went out of my way to neutre the Intel Management Engine. The ME is essentially an operating system inside the CPU that runs an undocumented opaque binary blob that is hidden from the main CPU and has access to memory, the keyboard and network and is listening on the network even when the main CPU is powered down. The ME runs in a more privileged state than your OS, so it can stay hidden and there's really no way to know what it is doing. Many BIOS menus have a "disable AMT" option, but it is unknown how much that really disables and how much is still fuctional. It only makes sense to not want to have this anywhere near your computer. You cannot remove it completely, otherwise Intel's bootguard will step in and the machine will shut itself off after 30 minutes. We can, however, reduce it to the bare minimum necessary to keep it running, but without any malicious code in it - atleast so we hope, depending on what the ROMP and BUP modules really do.

Getting the materials
I first purchased a SOIC-8 chip clip on Ebay for around 5€. Most people prefer the Pomona SOIC-8 clips and will tell you not to buy the cheap chinese knockoffs because you're not guaranteed to get a proper read/write, but it worked fine for me. The only downside was that I had to pay 10€+ in shipping while the product itself was just 5€... I also bought some jumper cables at my local hardware store for 2€.

There was not a lot of space between the pins on the SOIC clip, so I had to take the plastic off at the end of the jumper cable and put electrical tape between each wire so they wouldn't short eachother. It looked messy but it worked flawelessly. 

Spoiler:

Compiling coreboot
Next I downloaded all the necessary dependencies on my Raspberry Pi, git cloned coreboot and compiled it after configuring it. For the payload I decided to use Seabios.

Spoiler:

After about 8 (!!!) hours of compiling it was finally finished and I had a ROM file ready for flashing. There are pre-built ROMs you can find online if you don't want to do the compiling yourself, but I'm sure the compile times are a lot better if you're just smarter than me and don't decide to build it on your Raspberry Pi...

Flashing section

Next I took the battery out, unscrewed my thinkpad and removed the palmrest. Under the palmrest you'll find a piece of protective plastic that I peeled off to reveal the two SPI flash chips.

Spoiler:

Spoiler:

The top chip is 4MB and contains the BIOS and reset vector, and the bottom one is 8MB and has the Intel Management Engine firmware, plus the flash descriptor.

I started by putting the clip on the SPI1 chip containing the BIOS, and plugged the 8 jumper cables into the correct GPIO pins on my Raspberry Pi.

Spoiler:

Then from my RPi I used flashrom to read the SPI chips contents into two different files, and compared the md5 checksum of them to make sure they're both identical and that I have a reliable read.

Spoiler:

After confirming that I have a reliable read I flashed the compiled coreboot ROM.

Spoiler:

After that I did the same thing for the SPI2 chip containing the ME. Read the content of the chip into two files, compared the two to make sure I have a reliable read and then used me_cleaner on the dump to produce a clean modified image. I then wrote the cleaned image back on the chip.

And that's it! I put the palmrest back, screwed everything together and booted it. I was no longer presented with the Lenovo splash image, and my OS booted without any problems. I now have a (almost) free, but still modern laptop. I know I didn't cover the gritty details of the compiling, configuring and flashing sections because it was a lot of trial and error, but I hope you found the thread interesting or motivating at least.

Here are some resources that helped me:

https://www.stefanolaguardia.eu/2019/06/...kpad-x230/
https://www.coreboot.org/Board:lenovo/x230
https://www.chucknemeth.com/flash-lenovo-x230-coreboot/
https://github.com/merge/skulls

[zorrophreak]

I've been interested in the coreboot project for a good while and being interested in moving to the laptop line from Dell I think I'll find this very useful.

Thanks for the documentation!

[mothered]

I'm quite confident that @phyrrus9 will find this of Interest.

[zn0]

I've been interested in the coreboot project for a good while and being interested in moving to the laptop line from Dell I think I'll find this very useful.

Thanks for the documentation!

I was using a Dell XPS laptop before, and even though it's much more lightweight and faster I'm very happy with my x230. If you don't care as much about performance and just want a laptop that works for everyday browsing and programming I'd recommend the x200. You can libreboot this laptop and completely remove the ME and have a completely free laptop from the ground up, however it'll be a bit slow. Sadly we don't get the luxury of having both a completely free and fast computer at this time, and since I wanted a relatively modern laptop I have to put up with an almost free one.