Adding a USB Port to the ThinkPad X1 Nano (the Hard Way) - joshua stein

I wanted to add an internal USB port to my<br>ThinkPad X1 Nano<br>which should have been a fairly easy thing to do, but it wasn't.

Of course, if I were still using my<br>Framework Laptop<br>it would be as easy as plugging in a<br>custom module<br>but I've been using my X1 Nano as my primary laptop for quite some time now.

Table of Contents

Top

Logitech Mouse

M.2

Firmware Hacking?

Fingerprint Reader

USB Power

Designing a PCB

3D-Printed Shim

Logitech Mouse

As convenient as the TrackPoint is on my ThinkPad, having a mouse with a scroll<br>wheel and 4 buttons is very handy.<br>use<br>a Logitech mouse which can connect wirelessly to a<br>USB dongle<br>over RF, providing lower latency and better battery life than Bluetooth.<br>The mouse also supports Bluetooth but OpenBSD doesn't, so USB dongle it is.<br>This might seem annoying on a laptop with only 2 USB ports, but it's usually<br>plugged into a USB-C dock under my desk which also routes power to the laptop so<br>everything rides over a single USB-C cable and I don't even notice the dongle.

That is, until I unplug my laptop and this supposedly wireless mouse loses its<br>connection and I need to remember to bring the dongle along with a<br>USB-A-to-USB-C adapter.<br>Yuck.

I also have the same problem when using my AirPods with the laptop.<br>Since OpenBSD can't connect to them natively over Bluetooth, I use a<br>Creative BT-W3<br>to handle Bluetooth which then presents a USB audio interface to OpenBSD.<br>(Unfortunately I can't leave that connected all the time because as soon as I<br>switch the AirPods to connect to my phone, the BT-W3 will take over the<br>connection within about 10 seconds if I'm within range of my laptop.)

Clearly my life would be easier if OpenBSD had a Bluetooth stack again, but it's<br>a lot of work and I don't want to write it.<br>Perhaps it's easier to hide a USB port inside of the laptop where at least the<br>mouse dongle can hide out.

M.2

The X1 Nano has an available M.2 (B-Key) slot for adding an optional WWAN card.<br>On many other laptops, it would be straightforward to buy an<br>M.2 USB card,<br>install it in this slot, and instantly gain an internal USB port<br>(or<br>two).

Fun fact: in addition to providing a PCIe interface, M.2 slots also have pins<br>for providing a USB connection.<br>Many Wi-Fi cards that also provide a Bluetooth device use both of these sets of<br>pins to present the Wi-Fi interface over PCI and Bluetooth over USB.<br>There are a set of<br>4 configuration pins<br>that the card uses to tell the host what type of interfaces are being used.<br>M.2 USB cards don't even have to provide their own USB controller, they just<br>need to connect the M.2 USB pins to a USB port, shift 3.3V to 5V needed for USB,<br>and ground certain configuration pins.<br>The<br>schematic<br>for such a card shows how only the USB SSIC, CONFIG, VBAT, and GND pins<br>are wired up.

Unfortunately, Lenovo continues to implement a stupid<br>network card<br>whitelist<br>that IBM started over<br>20 years ago<br>on its ThinkPad models.<br>If the card in the M.2 slot is not advertising a known PCI vendor and product ID<br>in the whitelist contained in the BIOS (now UEFI firmware), the ThinkPad will<br>refuse to boot:

M.2 USB card (with port removed) plugged in...

...which causes an error

I briefly considering making a custom M.2 PCI card that forwarded the USB pins<br>but also added some kind of microcontroller that pretended to be a known good<br>WWAN card, at least as far as its vendor and product ID.<br>I also thought about a card that used some kind of timer chip to keep the<br>configuration pins disconnected long enough to let the machine boot while<br>thinking nothing is in the slot, and then connect them to the USB port.<br>These both seemed difficult to implement, so I started down a different route.

Firmware Hacking?

To investigate the whitelist, I first needed a valid WWAN card to know what<br>vendor and product ID to look for.<br>This took a bit of trial and error but I eventually found the<br>Qualcomm X55<br>card to work, which has a vendor of 105b (Foxconn) and a product of e0ab.

Next, I needed to look at the actual firmware code to see how its whitelist<br>worked.<br>After poking around the motherboard, I located the firmware flash chip right<br>next to the M.2 slot under a plastic sheet, and it's a<br>Winbond W25R256JV 32 Megabyte<br>8mm x 6mm chip.

Firmware flash chip

Winbond W25R256JV

Since this flash chip has such a low profile, my usual SOIC chip clips couldn't<br>grab onto it.<br>I didn't want to desolder it and risk damaging it, so I purchased a<br>pogopin probe<br>that worked well, though it's a bit tiresome to use because it requires a steady<br>hand applying downward pressure for about eight minutes for a full read and<br>write.

Using the probe with my<br>CH341A reader<br>and<br>AsProgrammer<br>on a Windows laptop (ironically, my Framework laptop), I was able to read the<br>firmware image and look for 5B 10 AB E0 (the vendor and product in<br>little-endian format).

Firmware contents in AsProgrammer

I changed E0 to E1 in both instances, hoping it would...