Add x280 port, based on coreboot 25.12 + atop SPD upstream patch

[NobodyNo0ne]

EDIT:

CoreBoot version specified to 25.12
Deguard tool updated to version that added X280 support (for X280 delta)

HOTP is on hold. Mine doesn't work, and Librem keys are out of stock, I need to ask for a quote from NitroKey.

X280 models with 16GB RAM now work as intended with patch.
TOTP should be fully functional.
Display issues rectified, thanks to @tlaurion, now no longer bodged with i915
CircleCI now uses X280 as seed for 25.12, thanks to @tlaurion

I think this PR is finally at a stage where I would have created the draft, if I knew they were public.

Now aware Draft PRs are visible

Original Post:

I have a port of heads for the x280. PR as draft since I have not:
Tested HOTP (I do not have a dongle YET)
Tested reproducibility (circleci)

I also need to change a couple things, since the coreboot version is currently labelled simply as 'x280'.

I had to use a different coreboot version since 25.09 did not seem to support the x280, and I am not cut out for backporting.

Do tell me if I am missing anything.

I would also like to thank @AlguienSasaki for helping me, and for his LibreBoot port.

---

Edits by @tlaurion

• When doing ports requiring patches being ported, always remember using

./docker_repro.sh make BOARD=xyz real.remove_canary_files-extract_patch_rebuild_what_changed
./docker_repro.sh make BOARD=xyz

Some notes for doc input:

• coreboot helpers need to be used on top of other board+specialization:
  • make BOARD=xyz coreboot.save_in_oldconfig_format_in_place
  • make BOARD=xyz coreboot.modify_and_save_oldconfig_in_place
  • make BOARD=xyz coreboot.save_in_defconfig_format_backup
• linux helpers need to be used on top of other board+specialization if needed:
  • make BOARD=xyz linux.save_in_olddefconfig_format_in_place

---

Testing

• Successful external flash link to circleci: X280-HOTP CircleCI and X280-TOTP CircleCI from commit af4fa60 using external programmer model Raspberry Pi Pico (pico-serprog) on 3.3V Voltage mode
• Boots successfully after the flashing:
• Setting clock prompt on first reboot: ok if triggered correctly after initial flashing and CMOS battery disconnected
• Clean boot detected (no keyring, nothing installed on disk): usb boot proposed and followed
• Boots on usb <- Note from @NobodyNo0ne There are documented issues with booting certain ISOs/USB installs. Live environments seem to work without fail. Tested multiple distros.
• OS Fedora install and reboot
• Heads functionality- no pubkey detected, but OS detected -> OEM-Factory-reset proposed. Done with X.Y.Z. hardwarekey e.g. nk3
• On reboot after re-ownership: generate new HOTP/TOTP <- Cannot test HOTP; No NitroKey
• wifi works based on OS Devuan <- Note from @NobodyNo0ne Installing Devuan with heads is a massive PITA
• PR0
  • flashprog -p internal (not locked)
  • lock_chip (locks the platform with PR0, if PR0 patch applied in fork or under patches/coreboot-25.12 and coreboot config contain proper preparation of the platform)
  • flashprog -p internal (reports locked)

[NobodyNo0ne]

Looking at what GitHub has just told me here CircleCI in fact does NOT work (I did NOT realise drafted PRs can be seen)

[tlaurion]

Ouch @NobodyNo0ne some cleanup will need to take place here. No clue why you impact 282 files with 33 commits and glancing over, i cannot explain how you come to this.

You deleted blobs/* files, which circleci depends on to download blobs needed by buikds (ME etc) which are not found which is why CircleCI fails. Also ou have not read porting guide https://osresearch.net/Porting/ nor https://osresearch.net/Development please do so first then add question here.

[NobodyNo0ne]

Ouch @NobodyNo0ne some cleanup will need to take place here. No clue why you impact 282 files with 33 commits and glancing over, i cannot explain how you come to this.

You deleted blobs/* files, which circleci depends on to download blobs needed by buikds (ME etc) which are not found which is why CircleCI fails. Also ou have not read porting guide https://osresearch.net/Porting/ nor https://osresearch.net/Development please do so first then add question here.

I did read it but if I am honest with you I just completely ignored CircleCI while porting. Many files impacted because I removed many files that were not X280 related over porting.
I also did not realise you could see draft PRs I was going to fix some of these GLARING problems hoping they were not brought into the limelight yet. I don't quite know how to respond.

^
TL;DR make a separate repo with just your stuff, and then merge it into heads, and THEN do a PR, and save yourself some dignity.

[NobodyNo0ne]

I'm working on making this PR not an absolute mess, sorry about all this I thought it worked like an E-Mail draft.

[NobodyNo0ne]

PR is now no longer an absolute mess. I think.

1. I hopefully have my commits verified. <- botched this a little bit but I got there in the end
2. 25.12 needs the patch. this was a waste of a commit

[tlaurion]

@NobodyNo0ne this pr is not based on origin/master of this repo, please git fetch origin/master, git rebase --signoff origin/master

[tlaurion]

on ab932f9

As discussed on matrix,

Added patch for SPI lock, changed config to not lock on build, added proper readme, signed commits properly. There may be more patches in order, especially for build (otherwise real.clean removes a bunch of the coreboot 25.12 directory and its a pain to get it all back.

As per matrix thread disscussion (for posterity)

Use Makefile helpers to reduce copile time and pain points; by using

./docker_repro.sh make BOARD=EOL_x280-maximized real.remove_canary_files-extract_patch_rebuild_what_changed
./docker_repro.sh make BOARD=EOL_x280-maximized

Makefile comments:

heads/Makefile

Lines 1148 to 1165 in 7902f1f

	real.remove_canary_files-extract_patch_rebuild_what_changed:
	@echo "Removing .canary files (build stamps) to force rebuild of board configurations."
	@echo "The next 'make' will then re-extract packages, re-apply patches, and rebuild changed targets (date-based)."
	@echo "It will also reinstall the necessary files under './install'."
	@echo "Limitations: If a patch creates a file in an extracted package directory, this approach may fail without further manual actions."
	@echo "In such cases, Git will inform you about the file that couldn't be created as expected. Simply delete those files and relaunch the build."
	@echo "This approach economizes time since most build artifacts do not need to be rebuilt, as the file dates should be the same as when you originally built them."
	@echo "Only a minimal time is needed for rebuilding, which is also good for your SSD."
	@echo "*** USE THIS APPROACH FIRST ***"
	@echo "Removing ./build .canary files..."
	@find ./build/ -type f -name ".canary" -print -delete || true
	@echo "Removing install/*/* content..."
	@find ./install/*/* -print -exec rm -rf {} + 2>/dev/null || true
	@echo "Removing coreboot board related artifact directory: $(build)/$(coreboot_dir)"
	rm -rf "$(build)/$(coreboot_dir)"
	@echo "Removing coreboot board related artifacts directory $(board_build)"
	rm -rf "$(board_build)"
	$(call overwrite_canary_if_coreboot_git)

[tlaurion]

From OP

HOTP is on hold. Mine doesn't work, and Librem keys are out of stock, and Nitrokey deliveries/orders are on hold outside the EU. this was rather short lived.

Nitrokey: @nestire @jans23 some problems shipping nk3 outside of EU?

Purism: @JonathonHall-Purism some Librem keys devices in production?

Thanks for updating, if there is issues tell me I'll open and pin issue under Heads, was not aware.

Cc @NobodyNo0ne

[jans23]

Nitrokey does ship worldwide but temporarily you have to request a quote for outside of the EU.

[tlaurion]

You reported on matrix thread that 4gb ram only was seen, reported by https://ticket.coreboot.org/issues/627 and fixed by https://review.coreboot.org/c/coreboot/+/91170

This means you will need to drop a patch on top of 25.12 since 25.12 was not really complete for x280, through gerrit's "Download ->Format patch" instructions git fetch https://review.coreboot.org/coreboot refs/changes/70/91170/5 && git format-patch -1 --stdout FETCH_HEAD > where_you_want_the_patch.patch

Attention: this will clone coreboot into working directory.

Something like the following, where XXXX needs to be the next patch number to be applied in proper order from the coreboot patches dir (change paths as needed):

mkdir ~/coreboot-test/
cd ~/coreboot-test/
git fetch https://review.coreboot.org/coreboot refs/changes/70/91170/5 && git format-patch -1 --stdout FETCH_HEAD > XXXX-mb_lenovo_sklkbl_spd-Fix_integer_overflow_91170.patch
mv XXXX-mb_lenovo_sklkbl_spd-Fix_integer_overflow_91170.patch ~/path_to_heads/patches/coreboot-25.12-patches/

And then

./docker_repro.sh make BOARD=EOL_x280-maximized real.remove_canary_files-extract_patch_rebuild_what_changed
./docker_repro.sh make BOARD=EOL_x280-maximized

[tlaurion]

c1b6293

No problem having it staging in this PR until heads-wiki pr is created and changes moved there, but once ready, you will have to clean the git history (git squash/amend/fixup+signoff) so that the final PR doesn't include those changes in it's final state (git keeps all files history, so your jpg and whatnot would otherwise make the repository size bigger for everyone in the future to download even it those were never needed).

[tlaurion]

2x x280-hotp-maximized currently built (seed + independent (unneeded independent hotp board rebuilt)

[tlaurion]

oh it no longer detects USBs /lib/modules/ehci-hcd.ko not found? !!!

That is unexpected....

I only got as far as booting (so it solved the screen issues) and not as far as using a USB. I assume its the same commit that did both
I don't think I have seen some of these options before. Main thing I see is 'bootmedia' and 'hotplug' (the rest is display related)
'=m'
I assume =m is wrong, if I did that, sorry, I need to check my keycaps. If not, check your keycaps.
CONFIG_USB_EHCI_HCD_PLATFORM=m I will leave alone for now though

Getting confused on why modules.cpio didn't have the modules in last build, but last circleci shows they are there?
https://app.circleci.com/pipelines/github/linuxboot/heads/1463/workflows/2b1c8bbd-8946-4fb8-9c30-0a75dc569e58/jobs/56996/parallel-runs/0/steps/0-105

I am tempted to revert to last working, and then merge your display edits, and then just ignore this happening. Thoughts?

Well new artifacts will be availabe soon for recent commit with kernel modules said to be there https://app.circleci.com/pipelines/github/linuxboot/heads/1463/workflows/2b1c8bbd-8946-4fb8-9c30-0a75dc569e58
Note: we are building x280-hotp-maximized twice in circle ci (3 board built not 2)

https://app.circleci.com/pipelines/github/linuxboot/heads/1463/workflows/2b1c8bbd-8946-4fb8-9c30-0a75dc569e58 was successful, now ci builds again for hotp and non-hotp

Waiting x280-maximized will produce results: CircleCi imposes concurrency limits.
Will build here https://app.circleci.com/pipelines/github/linuxboot/heads/1463/workflows/2b1c8bbd-8946-4fb8-9c30-0a75dc569e58/jobs/56997

[tlaurion]

have to go for now, but will read your tests later

Was confused because origin/master forces modules and cpio rebuilds since beginning of august.... maybe I missed something but no kernel modules in modules.cpio never supposed to happen :/

[tlaurion]

oh it no longer detects USBs /lib/modules/ehci-hcd.ko not found? !!!

That is unexpected....

I only got as far as booting (so it solved the screen issues) and not as far as using a USB. I assume its the same commit that did both
I don't think I have seen some of these options before. Main thing I see is 'bootmedia' and 'hotplug' (the rest is display related)
'=m'
I assume =m is wrong, if I did that, sorry, I need to check my keycaps. If not, check your keycaps.
CONFIG_USB_EHCI_HCD_PLATFORM=m I will leave alone for now though

Getting confused on why modules.cpio didn't have the modules in last build, but last circleci shows they are there?
https://app.circleci.com/pipelines/github/linuxboot/heads/1463/workflows/2b1c8bbd-8946-4fb8-9c30-0a75dc569e58/jobs/56996/parallel-runs/0/steps/0-105

I am tempted to revert to last working, and then merge your display edits, and then just ignore this happening. Thoughts?

Well new artifacts will be availabe soon for recent commit with kernel modules said to be there https://app.circleci.com/pipelines/github/linuxboot/heads/1463/workflows/2b1c8bbd-8946-4fb8-9c30-0a75dc569e58
Note: we are building x280-hotp-maximized twice in circle ci (3 board built not 2)

https://app.circleci.com/pipelines/github/linuxboot/heads/1463/workflows/2b1c8bbd-8946-4fb8-9c30-0a75dc569e58 was successful, now ci builds again for hotp and non-hotp

Waiting x280-maximized will produce results: CircleCi imposes concurrency limits. Will build here https://app.circleci.com/pipelines/github/linuxboot/heads/1463/workflows/2b1c8bbd-8946-4fb8-9c30-0a75dc569e58/jobs/56997

yep kernel modules there https://output.circle-artifacts.com/output/job/8e40dd3a-6918-4181-ba87-cdfbfe26e078/artifacts/0/build/x86/EOL_x280-maximized/hashes.txt :

2026-08-27 20:32:49+00:00 689bae5dc3e19320ed5c74f2a83a9d3cfd09a1c1 clean
19fc6bb44d9f53a1cdc7e75c51d602a399fb99480b058236bf926c5e17ca7bbb  build/x86/EOL_x280-maximized/modules.cpio
-----
fd0b3a857b941de96cbddd3a0b8673e03df08fd6b3f57375590cac2434f35e68  ./lib/modules/usbhid.ko
67a6e5107bda847c65e3e8863325ed3d8fa225689b2ce4e41ef8fc1cd7e02714  ./lib/modules/e1000e.ko
8216a4855da22b4d0210dac57dffde868d275e9adb8189df16e5c0ae1caacce7  ./lib/modules/ehci-hcd.ko
a8e5d72d8a1ecb13a841ecb6205c242c8a33591b09a7c3d14b94d913ebecb03a  ./lib/modules/ehci-pci.ko
e0792620e7f6102ca85e1d21c6931075313acb9e1245432e2f8e03d1f0e6db26  ./lib/modules/xhci-hcd.ko
69c4e11b92cae6efaabf8ba22cb9524e0d590512089f66551117d3c69b4f0096  ./lib/modules/xhci-pci.ko
903bfccd98baec3c226f5b37638d03fbbc7669a1f6cc777ba74cb21e90fb2a4c  ./lib/modules/usb-storage.ko
a863181a48631221ecd9c12f6c01f4f34e366b91c856fd811d17909525b77b28  ./lib/modules/mii.ko
1e9b5f4df226a7c4a31c25c8d03c7268773be737cce2be631f2a9f71b30e7b67  ./lib/modules/usbnet.ko
4cf92bf26d3d35e3d45119b8d943000372916ffca4ac277af024eaed9ce8303f  ./lib/modules/cdc_ether.ko
46949dd3513f0b6bd8281624c5f8ea1dd0eff9fc7940026cdaaccb7646414a33  ./lib/modules/cdc_ncm.ko
2bb84fc87428c07a0f0fc5fb81f83fb3a64bc2cc92fe431f7c1a6b041bf5ea56  ./lib/modules/cdc_eem.ko
-----

Artifact to test https://output.circle-artifacts.com/output/job/8e40dd3a-6918-4181-ba87-cdfbfe26e078/artifacts/0/build/x86/EOL_x280-maximized/heads-EOL_x280-maximized-202608271938-v0.2.1-3152-g689bae5.zip

(you can see in filename: 689bae5)

[tlaurion]

modified PR name; OP (PR description needs some cleanup to represent current state of the branch)

[tlaurion]

Let's see with af4fa60 if circleci produces rom with kernel modules in modules.cpio before flashing this time?

If there is issue with that build, this means something is yet missing in Makefile modules/linux to make things clean on warm cache rebuilts (prior build from circleci was on a clean, no cache, build)

[tlaurion]

On warm cache build for af4fa60 https://app.circleci.com/pipelines/github/linuxboot/heads/1465/workflows/c8f63b47-2b53-4be5-b258-5cf24ec0fb66 (will edit)

• x280 blobs are reused, ci skips it (good) https://app.circleci.com/pipelines/github/linuxboot/heads/1465/workflows/c8f63b47-2b53-4be5-b258-5cf24ec0fb66/jobs/57064/parallel-runs/0/steps/0-107
• x280-hotp-maximized builds fast (45s) https://app.circleci.com/pipelines/github/linuxboot/heads/1465/workflows/c8f63b47-2b53-4be5-b258-5cf24ec0fb66/jobs/57067
  • hashes.txt has proper modules.cpio content https://app.circleci.com/pipelines/github/linuxboot/heads/1465/workflows/c8f63b47-2b53-4be5-b258-5cf24ec0fb66/jobs/57067/parallel-runs/0/steps/0-105
• x280-maximized builds with modules.cpio ok https://app.circleci.com/pipelines/github/linuxboot/heads/1465/workflows/c8f63b47-2b53-4be5-b258-5cf24ec0fb66/jobs/57068/parallel-runs/0/steps/0-104

[tlaurion]

On warm cache build for af4fa60 https://app.circleci.com/pipelines/github/linuxboot/heads/1465/workflows/c8f63b47-2b53-4be5-b258-5cf24ec0fb66 (will edit)

* x280 blobs are reused, ci skips it (good) https://app.circleci.com/pipelines/github/linuxboot/heads/1465/workflows/c8f63b47-2b53-4be5-b258-5cf24ec0fb66/jobs/57064/parallel-runs/0/steps/0-107

* x280-hotp-maximized builds fast (45s) https://app.circleci.com/pipelines/github/linuxboot/heads/1465/workflows/c8f63b47-2b53-4be5-b258-5cf24ec0fb66/jobs/57067
  
  * hashes.txt has proper modules.cpio content https://app.circleci.com/pipelines/github/linuxboot/heads/1465/workflows/c8f63b47-2b53-4be5-b258-5cf24ec0fb66/jobs/57067/parallel-runs/0/steps/0-105

* x280-maximized builds with modules.cpio ok https://app.circleci.com/pipelines/github/linuxboot/heads/1465/workflows/c8f63b47-2b53-4be5-b258-5cf24ec0fb66/jobs/57068/parallel-runs/0/steps/0-104

@NobodyNo0ne https://output.circle-artifacts.com/output/job/ec5cfeec-6c92-4691-96e5-e23537780b0c/artifacts/0/build/x86/EOL_x280-maximized/heads-EOL_x280-maximized-202608271655-v0.2.1-3153-gaf4fa60.zip contains proper modules.cpio with usb modules as showed in previous comment

Please comment :)

[NobodyNo0ne]

have to go for now, but will read your tests later

Was confused because origin/master forces modules and cpio rebuilds since beginning of august.... maybe I missed something but no kernel modules in modules.cpio never supposed to happen :/

I thought you went so I was in a terminal the whole time

[tlaurion]

have to go for now, but will read your tests later
Was confused because origin/master forces modules and cpio rebuilds since beginning of august.... maybe I missed something but no kernel modules in modules.cpio never supposed to happen :/

I thought you went so I was in a terminal the whole time

Couldn't leave without my head empty of doubts, heading out now :)

[NobodyNo0ne]

have to go for now, but will read your tests later
Was confused because origin/master forces modules and cpio rebuilds since beginning of august.... maybe I missed something but no kernel modules in modules.cpio never supposed to happen :/

I thought you went so I was in a terminal the whole time

Couldn't leave without my head empty of doubts, heading out now :)

You in fact fixed USB.

[NobodyNo0ne]

#2198
Oh... well I'm glad we got CircleCI working properly!

So far in testing, Re-Ownership works etc. Booted into OS WiFi Works RAM patch works.

[tlaurion]

#2198 Oh... well I'm glad we got CircleCI working properly!

So far in testing, Re-Ownership works etc. Booted into OS WiFi Works RAM patch works.

Modify OP, maybe even mofigy porting.md but https://osresearch.net/Porting/#testing provides clear checkboxes to add in OP. Thanks

[NobodyNo0ne]

#2198 Oh... well I'm glad we got CircleCI working properly!
So far in testing, Re-Ownership works etc. Booted into OS WiFi Works RAM patch works.

Modify OP, maybe even mofigy porting.md but https://osresearch.net/Porting/#testing provides clear checkboxes to add in OP. Thanks

I was just testing the immediate USB issue. Will move to going through the checklist.

I will add the checklist to first comment/ Opening PR comment <- you beat me to it

I have also never had a non graphical installer work, which is rather unfortunate/ a bit annoying. Seems like a known/documented issue though (I have read the docs about this)

[tlaurion]

modified OP in case it wasn't clear what was needed there from link.

[NobodyNo0ne]

modified OP in case it wasn't clear what was needed there from link.

I think the main issue with testing is user error (me). Seems to all work. I had an isomount issue but it seems to have been a one-off? Cannot replicate it. This port of heads has also been my first time using it, which probably does not help.

Squashed commits. Requested change looks already changed locally/ on git. not sure why it hasn't updated, though I haven't done this before, maybe this is normal. I cannot find this requested change. I see one in the thread about duplicate build in CircleCI but that looks resolved on my end?

2x x280-hotp-maximized currently built (seed + independent (unneeded independent hotp board rebuilt)

I do not see this in the current repo or locally

[NobodyNo0ne]

I have gone through this. It finally doesn't say anything is left but I feel like I already did most of it. I was probably doing something wrong.

[NobodyNo0ne]

This should be fixed but github hasnt marked as outdated <- it now has

[NobodyNo0ne]

Oh why is circleci failing NOW

==> ./build/x86/log/coreboot-blobs-25.12.configure.log <==
echo -e 'all:\n\ttouch .built' > Makefile

==> ./build/x86/log/coreboot-blobs-25.12.log <==
make -C "/root/heads/build/x86/coreboot-25.12/3rdparty" 
make[1]: Entering directory '/root/heads/build/x86/coreboot-25.12/3rdparty'
touch .built
make[1]: Leaving directory '/root/heads/build/x86/coreboot-25.12/3rdparty'

Exited with code exit status 1

But I did not change modules/coreboot in this commit :(

1d60fc2 built but not 10f2093
The latter was just me going through the requested changes trying to figure out what was still holding it up

I am hoping it was just the patch file.

Fixed! :D

[tlaurion]

LGTM! Didn't try to optimize the blob script, thought there were common functions to reuse now, but good for merge either way.

Oh. Add yourself as board tester and add board under doc/BOARD_OWNER_AND_TESTERS.md

Thanks!

[NobodyNo0ne]

LGTM! Didn't try to optimize the blob script, thought there were common functions to reuse now, but good for merge either way.

Oh. Add yourself as board tester and add board under doc/BOARD_OWNER_AND_TESTERS.md

Thanks!

'LGTM'?
Also, I will add @AlguienSasaki to Board testers/owners, though he has been away in the last few days and hasn't tested final builds. His help has been much appreciated.

When I can, I will get a NitroKey and test that to check that box (also to use it for myself). I see Libreboot has started selling preflashed X280 laptops as well, I wonder if X280 based NitroPads will happen? :)

Is there a separate .md where I attribute credit/processes, or is that not needed?
One of my friends also helped me here and there while waiting for android to compile. (He is doing his own port too! But not heads related). Mostly RTFM, but if this PR is anything to go by, very helpful.