Porting ThinkPad X61 to coreboot using AI-assisted reverse engineering

The ThinkPad X61 has been successfully ported to coreboot, demonstrating that Large Language Models (LLMs) can significantly accelerate the reverse engineering of legacy firmware. By utilizing AI agents to analyze vendor BIOS modules, a developer reduced a process that typically takes three to six months down to a few weeks, though the project highlights that deep domain expertise remains essential for correctness and upstreaming.

AI-Assisted Reverse Engineering Workflow

LLMs can transform the speed of firmware reverse engineering by automating the analysis of binary blobs and translating them into usable code. In the case of the ThinkPad X61, the process involved several distinct phases:

Data Extraction and Tooling

To establish a baseline, the developer used traditional coreboot tools to dump known good values from a working system. This included using inteltool for PCI configuration and chipset registers, acpidump and iasl for ACPI tables, and ectool for Embedded Controller (EC) RAM analysis.

The vendor Phoenix BIOS was split into modules using bios_extract. To enable the AI agent to interact with the firmware, the developer provided it with:

  • ghidra-cli: Used for analyzing PE32 modules, such as the Intel Memory Reference Code (MRC) used in raminit.
  • radare2: Used for analyzing 16-bit real mode glue code.

The Role of LLMs in Code Generation

While the developer initially joked about "vibe reverse engineering" (generating working code in two prompts without looking at it), the reality required significant human steering. The LLM was used to extract the raminit initialization sequence, but the developer had to provide critical corrections based on knowledge of similar platforms (X60 and X200).

Key areas where the LLM required manual intervention included:

  • Hardware Specifics: Identifying a GPIO mux for SMBUS on GPIO42 that affects SPD/EEPROM visibility.
  • Register Accuracy: Correcting 32-bit writes to 16-bit registers and identifying the correct MCHBAR register for GMCH FSB frequency.
  • Memory Semantics: Resolving confusion between coreboot's CAS encoding and the MRC's encoding.
  • Hardware Limits: Correcting memory controller support to DDR2 533MT/s and 666MT/s (rather than 666/800MT/s).

Hardware Testing and Flashing

Bringing up the X61 required a physical testing loop using a docking station with an RS232 UART connector for serial output.

To flash the firmware, the developer used a CH341A SPI programmer with a clip attached to the SOIC8 flash chip on the bottom of the board. The flashing command used was: flashprog -p ch341a_spi --ifd -i bios -w build/coreboot.rom

The developer noted that for ICH9/ICH10 laptops, it is possible to remove the Management Engine (ME) firmware to reclaim space for coreboot, a process that likely applies to the X61 as well.

Upstreaming and Quality Assurance

Moving from a "bring-up hack" to upstreamable chipset code required a rigorous review process. A review by Angel Pons revealed several issues introduced by the AI-assisted process:

  • Hallucinations: The code contained incorrect register names and hallucinated register block semantics in the GM965 0xa00 MCHBAR range.
  • Logic Errors: Timing tables were indexed incorrectly, and some bitfields had the wrong meaning, leading to code that worked only on the developer's specific DIMM combinations.
  • Hardcoding: The southbridge code contained hardcoded init bits and device enables specific to the X61 rather than the general chipset.

Broader Implications for Firmware

This project suggests that the barrier to entry for reverse engineering closed-source firmware is dropping. The developer posits that this could eventually make the reverse engineering of Intel FSP (Firmware Support Package) feasible, as FSP is 32-bit PE code that Ghidra can analyze effectively.

Community Insights

Discussion among the community highlighted the utility of this approach for non-developers. One user mentioned a designer friend who "vibe coded" a working driver for an unsupported Wacom tablet using a similar iterative process of plugging, getting data, and transforming it. Others noted that while LLMs lower the barrier for "idiots" to attempt ports, there is a bit of a trade-off in the loss of the deep skill acquisition that comes from manual reverse engineering.

Future Extensions

Beyond coreboot, the ThinkPad X61 has been ported as one of the first x86 platforms supported by fstart, a coreboot/u-boot alternative written in Rust.

Sources