So, recently I was hanging around with Lena and sela - two friends of mine, and two fellow hackers, shitposters, you name it.

We stayed together for five days, and in those five days we got to do some stuff together - mainly it was them assisting me with stuff I cannot do, like swapping my GPU with another one because I cannot do precision work; crimping some Ethernet cables to use within my house; playing Mario Kart… and yes, the very reason this post exists, “Libreboot”-ing a ThinkPad T60.

A quick disclaimer

This is not intended to be a tutorial, but merely my experience as someone who never ever saw a Corebooted machine, nor seeing a machine flashed live. However, Lena will have a writeup for this specific machine very soon and it will be my due diligence to link it here - also because she will cover this very episode and you’ll get to read it from her (more technical and skilled) viewpoint.

This is also intended to be a blog post where I collect my thoughts, rants, and whatever I had at the time of the experience, on the whole Coreboot thing.

So, where do I start?

I’ve known Coreboot as a reality, but I never actually dug deep on it, so, to me, Coreboot was to computers like Linux is to a Windows user - a “thing”.

Of course, I’ve learned from Lena and sela that this is not actually the case. Coreboot is the “main project” and its “raw” form is customized, compiled and distributed by OEMs for their own laptops. So basically everything “with Coreboot on it” is actually using a distribution of Coreboot - and there, my brain quickly made the analogy between Linux and its distributions - however, looking at it while I am writing this post, probably it’s more akin to custom Linux kernels for Android phones (I miss modding an Android phone, help!)

The major “flashed” Coreboot distribution seems to be Libreboot - however, it also seems to contain no “vendor blobs” whatsoever, so it’s finnicky as hell. Or at least, that’s what I am still assuming, but I would not know since the T60 we had to flash was actually a “very straightforward unit” as far as the Libreboot guide was concerned. Right?

Some days before

Of course, when people live far apart, hanging around together means tons of preparation.

I had a conversation with Lena some days prior, where she introduced me to the possibility of her bringing this unit over for the specific purpose of flashing it. I could also have chosen to keep the flashed unit, but in the end I did not, because, despite my enormous will to have at least a ThinkPad (and that was one of the last ThinkPads to have the IBM logo on it - which is cool) the machine wasn’t upgraded to support any 64 bit OS, and while the CPU is socketed and therefore swappable, I think it’s best that Lena does other experiments with the unit, also because, as I briefly cited before, I cannot do precison work, so I cannot tear down a laptop, put it all together and expect myself to not have screwed that up.

The other ThinkPad she had was a T410i, but it had a broken screen and keyboard, and, while I could have used it as a decent homeserver, I thought that at least the T60 was worth the challenge.

So we agreed, and she brought the T60 with her.

(I actually kind of regret not having kept the T60 because, despite it all, for all it mattered it would’ve been fun to try and upgrade it despite my disability. It could’ve been a great testbed to regain my dexterity which is slowly but surely dying, but that’s another story.)

Some days later, Lena and sela came here, we stayed together a bunch, we also talked a bunch, enjoyed our time, and finally, when we had a little bit more time, we embarked on the Libreboot journey.

The Libreboot day

The premise was to use this blog post they’d already made for a similar laptop, the T60p to also flash the T60. To their judgement, the T60 should be the same if not for the fact that it uses an Intel integrated GPU, and therefore we didn’t need to dump the VGA BIOS, which is a proprietary blob (which Libreboot doesn’t have) that is present on the T60p because that model uses and AMD discrete graphics.

We had to do some prep work because, for some reason, when we turned on the laptop we discovered it was trying to boot Windows 10 on 32 bits, which is incredible and also “wtf why would anyone even dare to use Windows 10 on a machine that age?” but I don’t know, maybe a 70 year old ex-corpo businessman was this affectionate to his work laptop to literally succumb to the horrible slowness of modern Windows on old hard disks and limited RAM. But I wouldn’t know, would I? And also, the CMOS battery was dead, so we had to replace it.

Anyway, Windows was out, and Arch Linux 32 was in - except, they have some quite funky problem with the latest Live ISO so we had to disable their package signature verification to install the distro (and I won’t tell anyone how to do it because it’s an unsafe operation!) And with some very fucky duct tape work, we had another CMOS battery ready for this unit.

Other than this, we just booted the machine to Arch, set up SSH because no one would want to really really work by typing directly on that machine (even though the keyboard was so damn good I’d want it for my main workstation and I am not even joking), brought the machine to the LAN via Ethernet (it was better than having to configure Wi-Fi on a machine this old) and… we were off to the races!

The first steps were obviously easy:

• Set the kernel argument to give us permissions to read from (and write to) whichever memory addresses we want
• Reboot the machine
• Take the original BIOS dump
• Move the dump somewhere else, just in case (which still resides in my laptop - and probably I should send it back to Lena, for archival purposes)

At this point, we began reading the guide they’d done for the T60p, and in the meantime we were cross-referencing the Libreboot official guide. Turns out, the T60 and T60p both can flash their own BIOSes from within the OS, so we didn’t have to take apart the machine again, or really more than what was necessary to swap out the CMOS battery.

There’s only one obstacle: the BIOS region you booted from is protected by a register that the NVRAM keeps track of. So we couldn’t “flash it all at once.” Scary?

The Libreboot guide told us that the flasher would error out but that would actually be fine for the sake of the project because we could boot from within Libreboot in the other region of the BIOS later on, so we proceeded to do exactly what we were told to - that is, flash the “unprotected region” first, come back booting from that region which would be protected then, and flash again to make the old protected region filled with Libreboot. Cool.

Except…

We’re fucked

Yeah, we got all the errors the guide told us we’d get in the exact precise way, and we rebooted the machine in the exact precise way the guide told us to do.. but the machine was not booting.

At that point Lena thought to just keep the unit there, because probably it was doing memory testing or something like that. At some point we also speculated that probably the video output was not initialized, and that we needed a serial connection to the computer. But it still wasn’t booting.

Almost lost, we did some battery tests, to see if the battery was shooting the computer: unplugged, and nothing. Only the battery plugged, and nothing. Battery and AC power again, nothing.

At that point I reminded the unfortunate hackers that the value of that funny register was set to 1, which meant that the old protected region should still be there, and that if we unplug the CMOS battery and try booting then, we’d at least be able to try flashing again.

So we unplugged the CMOS battery and… beeps. Beeps citing a CPU issue? How?

Okay okay, we fucked up. End of the game.

Or is it?

At this point, the only sane option would be to tear apart the machine, and to reflash the BIOS with an external programmer. But…

We’re insane

And so we did indeed tear apart the machine to get to the motherboard, but instead of flashing the stock BIOS, we tried flashing Libreboot again. Because why not? What is there to lose?

For the SPI flasher, I remembered I had a Raspberry Pi 5 somewhere, and I had them flash it and configure it for this purpose; for the cabling, we didn’t have any jumper cables, any clips, anything… but we were crimping Ethernet cables, remember? So we just took a piece of Cat6, stripped it, and manually placed it where it needed to be: five cables, one taped to ground, and the other four were held by hand. Great!

And for the work space… we only had the floor. A dirty floor. Whatever, it’ll do!

And so the prep work began, and at this point the house cat was staring at us like we were completely possessed people offering parts of who-knows-what to an unspecified techno-god, or probably not. Thing is, she was staring at us, her eyes very much open, for the entire time.

Once everything was in place the setup was this: the T60 motherboard on the floor, with only the barrel plug module connected and the power cord connected too because we needed 3V power to the chip and there was clearly no better way than to letting that be handled by the original laptop charger; a Raspberry Pi 5 with five cables frankenstein’d onto the GPIO pins (and actually one of them made contact with another GPIO pin, but it didn’t matter for us, so we didn’t really bother to isolate that one); I was holding a torchlight to light up the area where the BIOS chip was located, and also I was responsible to send the flash command to the Pi via another laptop connected via SSH to it; Lena and sela were holding two cables each, and both were on the ground, probably also hurting, judging by the position they were holding; my boyfriend was offering all of us emotional support, and also taking photos because I couldn’t; and our house cat was still staring at us like we were about to cause an explosion.

Trial one, Lena preps the flashprog command for me, then she returns to her position. Once everything’s ready I send the command and… error. The chip is detected, but it could be multiple things, and we had to specify which one.

I panic, then we all remember that we actually flashed the chip once, and that in that case we already had the model number of the chip from essentially within the motherboard programmer itself. Since Lena keeps notes on everything, I sourced her notes, then I fixed up the command in the most panicked-gotta-go-fast way.

Trial two, everything is in place, Lena and sela try not to shake too much on the motherboard, then they give me the signal. I launch the command, and it does something.

Few seconds of absolute anxiety.

Then the command says it’s verifying the contents written. Wait, did it really flash it? Were we done?

Then it says that the contents are verified. Wait, we did really do it! Fuck, we did it! Awesome!

Now, will it boot?

It boots!

And it’s the best thing, after an afternoon spent on pure anxiety and silly jokes to not feel bad too much.

Wait, does this thing have UEFI now?

It’s the end, or is it?

Hopefully I will see this T60 again; maybe next time we will improvise a CPU swap on it? Or a RAM max out? In all honesty, and as I said, I quite regret not having it with me, because it could’ve been a ton of fun. But also it could’ve been the best companion to write those blog posts, because I often get distracted while working on them from my workstation or from my laptop.

In any case, this is the end of the blog post. Many many thanks to Lena and sela for coming here and spending an entire weekend with me and my boyfriend (and our cat) and I really really hope to embark in another hacky journey with them again, sometime in the future - also because it doesn’t happen to me to do this kind of stuff, but it’s interesting and I love when I am correctly shown things, or better, I love when I am also involved in hacky stuff, and their dedication to that effort was honestly truly appreciated.

Until next time, this was Shit Nao Says: Poor Hacker Edition! And go, go, read Lena’s blog next!