If you are able to extract it from the executable distributed by Lenovo it should be good. Do not get it from some random forum or website.
If you can't the best way is to read it directly from the flash using the Raspberry and the clip.
```
______
1--| O |--8
2--| |--7
3--| |--6
4--|______|--5
```
Remeber to research your chip model and manufacturer (in this guide a Macronix MX25L6405) and double check the pin layout using the official datasheet.
Check that all the checksums do match. In case they don't there's probably something wrong in the clip position or in the wiring. Remember that no pin should left floating even if it's not useful for the operation. /WP and /HOLD should be always connected to something like GND.
## Continue with coreboot build
Now reassemble the x220, boot Qubes and copy bios1.bin from the RaspberryPi to the AppVM created before in `~/Build/x220-coreboot/binaries/bios.bin`.
Open again a terminal in the AppVM:
```
cd ~/Build/x220-coreboot/
./cb-helper split_bios
./cb-helper neuter_me
./cb-helper pre_build_coreboot
```
Now the `cb-helper` script is prepared to build coreboot with SeaBIOS as primary payload and Grub2 as a secondary payload. In this specific guide we do not use SeaBIOS and directly use Grub2 as a primary payload.
This is an advantage for some reasons:
* Faster boot
* Less code running
And a disadvantage for some others:
* No BIOS like configuration available
* Probable problems with other operating systems
* Missing utilities like nvramcui
Now edit grub.cfg
`~/Build/x220/coreboot/config/grub.cfg`
Replace at the beginning of the file
```
set prefix=(memdisk)/boot/grub
insmod nativedisk
insmod ehci
insmod ohci
insmod uhci
insmod usb
insmod usbms
insmod part_msdos
insmod ext2
insmod lvm
insmod gcry_rijndael
insmod gcry_sha256
insmod luks
insmod cryptodisk
# insmod usbserial_pl2303
# insmod usbserial_ftdi
# insmod usbserial_usbdebug
insmod gfxmenu
insmod gfxterm_menu
insmod gfxterm_background
insmod chain
insmod jpeg
# Serial and keyboard configuration, very important.
# serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
# terminal_input --append serial
# terminal_output --append serial
terminal_input --append at_keyboard
terminal_output --append cbmemc
gfxpayload=keep
terminal_output --append gfxterm
set menu_color_normal=white/black
set menu_color_highlight=white/cyan
# Default to first option, automatically boot after 1 second
set default="0>0"
set timeout=1
# This is useful when using 'cat' on long files on GRUB terminal
set pager=1
# Set a background image from CBFS
background_image (cbfsdisk)/background.jpg
# Set DejaVu Sans Mono as the default font
loadfont (cbfsdisk)/dejavusansmono.pf2
# Default keymap
keymap usqwerty
```
And add the following menuentry:
** THIS IS AN EXAMPLE YOU SHOULD GET IT FROM YOUR ORIGINAL grub.cfg WITH YOUR DISK UUID AND KERNEL VERSIONS **
```
menuentry 'Qubes, with Xen hypervisor FDE' --class qubes --class gnu-linux --class gnu --class os --class xen $menuentry_id_option 'xen-gnulinux-simple-1c874f0f-b41d-4120-8058-b327554c11bf' {
The only difference with the original is the addition of
* cryptomount -a
* set root='lvm/qubes_dom0-boot'
The below example of .config should work without any modification given that the steps above have been done correctly, however some configurations depends on personal needs and should be changed. Refer to the coreboot wiki for more information https://www.coreboot.org/Coreboot_Options
From now on keep in mind that any error may cause data loss. Even not doing any error may cause data loss. Please make a full backup bedofre going on.
Boot a live archlinux or any other live distro which has cryptsetup, lvm and dd installed. In this part it is assumed the device with Qubes is `/dev/sda`.
```
fdisk -l /dev/sda
Device Boot Start End Sectors Size Id Type
/dev/sda1 2048 2099199 2097151 1.0 G 83 Linux
/dev/sda2 2099200 468862127 466762927 222.6G 83 Linux
```
Take note of the offset values.
Copy on an external device a backup of the boot partition:
Wait for the process to complete. Do not stop it for any reason.
```
cryptsetup luksOpen /dev/sda1 qubespv
pvresize /dev/mapper/qubespv
lvcreate -n boot -l100%FREE qubes_dom0
dd if=/mnt/backup/bios.dd of /dev/mapper/qubes_dom0-boot
```
## Reboot
Reboot. You should now be prompted two times for your LUKS passphrase: this is because the Grub installed within the Flash has no way to pass the actual passphrase to the kernel. A workaround to this issue is explained here https://wiki.parabola.nu/Installing_Parabola_on_Libreboot_with_full_disk_encryption_(including_/boot)#Bonus:_Using_a_key_file_to_unlock_.2Fboot.2F
