Building Your Coreboot ROM Image

Hello! Welcome back to the Secure ThinkPad project.

In our last lesson, we meticulously crafted the blueprint for our new firmware by creating the .config file. We specified everything from the mainboard model to the exact binary blobs to include, and we selected SeaBIOS as our payload. Think of it as completing the architectural drawings for a new building.

Today, we move from planning to production. We will execute the compilation process, turning our source code and configuration into a single, tangible file: the Coreboot ROM image. This is the culmination of all our software-side preparations before we open up the laptop.

This lesson covers the final learning outcome in Module 3: Compile the configured source code to produce a final Coreboot ROM image.

Estimated time to complete: 60 minutes (most of which is waiting for the computer to compile the code).

1. Building the Toolchain: The Cross-Compiler

Before we can compile Coreboot itself, we need to build the tools to do so. The computer you're working on (likely an x86_64 machine) needs to compile code for the x230's boot environment, which involves different processor modes (e.g., 32-bit for early initialization). A compiler that runs on one architecture but produces code for another is called a cross-compiler.

Coreboot is particular about the version of the GCC toolchain it uses, so we'll use the build system to create the exact versions it needs. This is analogous to fabricating custom tools for a specialized manufacturing line before starting production.

From the root of your coreboot directory, run the following commands:

# Still in the ~/coreboot directory
make crossgcc-i386 CPUS=$(nproc)
make crossgcc-x64 CPUS=$(nproc)

What's happening here?

• make crossgcc-...: This command tells the build system to compile the specific GCC toolchain for the target architecture (i386 and x64).
• CPUS=$(nproc): This is an optimization. It tells make to use all available CPU cores to parallelize the compilation, significantly speeding up the process. As someone familiar with optimizing computational tasks, you'll appreciate how much time this saves.

This step can take 10-20 minutes depending on your computer's performance.

📖 Reading (5 mins)

The guides by Kenny Ballou and Chuck Nemeth both begin the compilation phase with this step. Skim through their compilation sections to see how this fits into the overall workflow.

Coreboot for x230 - Kenny Ballou (Coreboot Image Compilation)
Flashing my Lenovo x230 with Coreboot - Chuck Nemeth (Prepare the Files (Coreboot Git Clone and Crossgcc Build))

2. The Main Event: Compiling the Coreboot ROM

With the toolchain in place, we are ready for the final step. The single make command will now read your .config blueprint, compile thousands of source files, integrate the blobs you provided (descriptor.bin, gbe.bin, and your neutralized me.bin), and link everything together into a final firmware image.

This is the moment the factory floor springs to life.

# Ensure you are in the root of the ~/coreboot directory
make -j$(nproc)

What's happening here?

• make: This is the master command that orchestrates the entire build.
• -j$(nproc): Similar to the CPUS flag before, the -j flag tells make to run compilation jobs in parallel across all your CPU cores.

This process is computationally intensive and will take a considerable amount of time, anywhere from 15 to 45 minutes. It's the perfect opportunity to review the disassembly guides for the next module or simply step away for a bit.

🎥 Watch (3 mins)

The following clips show this compilation process in action on different machines. It's not complex, but seeing the successful completion and the resulting file can be reassuring.

(Focus on the make command and the discussion of the build/coreboot.rom output file).
Make Your ThinkPad Great Again [T440p with Coreboot]{6} (This clip shows the make command running and the check for the final ROM).

3. Verifying the Output

Once the make command finishes without errors, your custom firmware has been created. The final product is a file named coreboot.rom located in the build/ subdirectory.

Let's verify its existence and size:

ls -lh build/coreboot.rom

You should see an output like this:
-rw-r--r-- 1 user user 12M Oct 26 14:30 build/coreboot.rom

The key is that the file exists and is 12M (12 Megabytes) in size. This confirms that the build system has created a full 12MB image, corresponding to the total size of the two flash chips on the x230 motherboard, as we specified in the configuration.

4. Finalizing the Image for Flashing

This is a subtle but critical step specific to the x230. The build/coreboot.rom file is a complete 12MB image. It's a concatenation of the binary blobs we provided (which occupy the lower addresses) and the new BIOS region (the CBFS filesystem containing SeaBIOS and other components) that we just compiled.

The x230 motherboard has two physical flash chips:

• An 8MB chip (the "bottom" chip)
• A 4MB chip (the "top" chip)

The BIOS region that Coreboot replaces resides entirely on the top 4MB chip. The bottom 8MB chip holds the Flash Descriptor, GbE firmware, and the Intel ME region. When we performed the me_cleaner step, we were modifying a portion of what will be on this bottom chip.

When we physically flash the chips, we will write to the top chip. Therefore, we need to extract the corresponding top 4MB from our complete 12MB image. We can do this precisely with the dd utility.

# From your ~/coreboot directory
dd if=build/coreboot.rom of=x230_coreboot_4mb.rom bs=1M skip=8

Dissecting the command:

• dd: A classic Unix utility for low-level copying of data.
• if=build/coreboot.rom: Specifies the input file.
• of=x230_coreboot_4mb.rom: Specifies the output file. I've given it a descriptive name.
• bs=1M: Sets the block size to 1 Megabyte.
• skip=8: This is the crucial part. It tells dd to skip the first 8 blocks (i.e., the first 8MB) of the input file.

The result, x230_coreboot_4mb.rom, is a 4MB file containing only the data for the top flash chip. This is the file you will use when you connect your hardware flasher in the next module.

Conclusion

Congratulations! You have successfully navigated the entire Coreboot build process. You've gone from raw source code to a final, flashable firmware image that is tailored to your hardware and hardened by removing the Intel ME. This x230_coreboot_4mb.rom file is the key that will unlock your ThinkPad's hardware.

Key Takeaways:

• Compiling Coreboot first requires building a specific cross-compiler toolchain using make crossgcc-....
• The make command, guided by your .config file, automates the complex process of compiling and linking the source code and blobs into a final image.
• The successful output is a build/coreboot.rom file, which for the x230 is 12MB in size.
• For flashing the x230's top BIOS chip, you must extract the final 4MB of the coreboot.rom image, which we accomplished using the dd command.

Next Up

We are now finished with Module 3 and the software preparation phase. The next module, "Hardware Surgery," takes us into the physical realm. In our next lesson, we will begin by creating a detailed plan for disassembling your x230. You will learn how to consult official service manuals to safely access the motherboard and locate the BIOS chip we need to flash.