I have two ThinkPad T400 laptops running Libreboot. They’re over a decade old, but they’re by far my favorite laptops for programming: they’re durable, have a fantastic keyboard, and all parts are easily replaceable. After upgrading the T400 with an SSD and installing Linux and a tiling window manager, it performs surprisingly well. Even better, everything from LEDs to backlight PWM is software-controllable.
This post shows how to customize the Libreboot ROM using coreboot parameters. It also covers some of the T400’s internals, such as important values in EC RAM and how to control the backlight PWM.
- Flashing a damaged ROM can brick your laptop.
- Setting the wrong backlight modulation frequency can cause flickering. Be extra careful if you have epilepsy.
- Writing to the wrong address in EC RAM can have unintended consequences.
Proceed at your own risk.
Configuring the ROM
This section assumes that you’re already familiar with Libreboot’s installation instructions.
Customizing NVRAM Parameters
Disabling Loud Beeps
The following commands disable the loud beeps that are produced when the battery is running low or when the charger is connected or disconnected.
./nvramtool -C libreboot.rom -w low_battery_beep=Disable ./nvramtool -C libreboot.rom -w power_management_beeps=Disable
Swapping Fn and Ctrl
The Fn key on the T400 is to the left of the Ctrl key, which is a slightly unusual choice. I prefer this layout because it moves Ctrl closer to the letter keys, but it is possible to swap the Fn and Ctrl keys if desired:
./nvramtool -C libreboot.rom -w fn_ctrl_swap=Enable
Disabling Unnecessary Hardware
Some T400 laptops support WWAN and Bluetooth. I recommend disabling these features if you don’t need them. This is especially important for WWAN because the chip runs a proprietary RTOS and normally has DMA.
./nvramtool -C libreboot.rom -w bluetooth=Disable ./nvramtool -C libreboot.rom -w wwan=Disable
Verifying the Settings
Make sure everything is set up correctly by printing the list of parameters and corresponding values:
./nvramtool -C libreboot.rom -a
Intel’s P8600 CPU has a bug that causes the system to become unstable when certain hardware virtualization features are used. There are two possible solutions to this problem:
- Unload the
kvm_intelkernel module and use software virtualization instead. This is likely too slow for most use cases.
- Install and load Intel’s non-free microcode.
If you use hardware virtualization without having microcode updates applied, you may lose data.
Backlight PWM Control
This step will likely no longer be necessary starting from the Libreboot release after version 20160907.
The T400’s backlight can be controlled by writing to the
register, which can be found at address
The 16 most significant bits are the backlight modulation frequency;
the 16 least significant bits control the duty cycle.
The duty cycle determines the backlight’s relative brightness.
If it is
0x0000, the backlight is off;
if it is equal to the modulation frequency, the backlight is at maximum
The Libreboot project recommends the following value as a starting point:
intel_reg write 0x00061254 0x60016001
I’ve found the following to work slightly better for me:
intel_reg write 0x00061254 0x44004400
EC RAM Addresses
Addresses in the EC’s RAM can be read from and written to using coreboot’s
ectool, which can be found in
util/ectool/ in the coreboot source tree.
A number of hardware features can be controlled by writing to EC memory.
The ThinkLight (keyboard light) is controlled by the EC.
Its state is stored in
The ThinkLight LED is on if bit
By default, the EC handles MUTE key events without producing a scancode. When another volume key is pressed, the EC unmutes the speakers. While the speakers are muted by the EC, low battery and power management beeps are also silenced if they have not already been disabled entirely.
0x40 at address
0x30 in EC
RAM controls whether the speakers are muted.
Personally, I prefer to have the OS (rather than the EC) handle the MUTE button for a number of reasons:
- It allows the window manager or desktop environment to accurately indicate whether the speakers are muted.
- It makes it possible for software to unmute the speakers.
- It allows the OS to mute any headphones or external speakers that may be connected, not just the built-in speakers.
- It makes it possible to remap the MUTE key.
The default behavior can be changed by setting bit
0x40 at address
# Default: embedded controller handles MUTE key ectool -w 0x03 -z 0x00 # Better: operating system handles MUTE key ectool -w 0x03 -z 0x40
RF Kill Switch
The state of the T400’s RF kill switch, which
disables Wi-Fi and Bluetooth, is stored in EC
RAM as bit
0x02 at address
Calibrating the Battery
The T400’s battery can be calibrated by writing byte
0x07 to address
Make sure that battery and charger are connected, then run the following
ectool -w 0x23 -z 0x07
The battery will be discharged and then charged again. Keep the charger plugged in until this is done.
Controlling the Status LEDs
On Linux, the power and sleep LEDs can
be controlled through ACPI by writing to
echo '0 <STATE>' > /proc/acpi/ibm/led # Power LED echo '7 <STATE>' > /proc/acpi/ibm/led # Sleep LED
<STATE> must be
thinkpad_acpi module also exposes these
LEDs, along with a few other hardware
components, through sysfs.