A few years ago I decided to purchase a Lenovo M700 Tiny for around $120 from a link on deals site OzBargain for the purpose of using it plugged into a TV to playback video using Kodi and whatnot. They are apparently quite popular for this purpose as well as for Proxmox due to their diminuitive footprint and low power requirements.
After spending far too much adding two SSDs and some more RAM to it, I stumbled upon a forum thread in which a user from New Zealand called mobilenvidia managed to upgrade the stock i5 6500T to a more recent CPU (a 9100T) by doing a ton of hex editing. I decided to investigate, and after purchasing a CH341 BIOS reader (which I later learnt you should not use) I managed to read the stock BIOS off of the Winbond chip, only to give up on it after getting lost in hex offsets and whatnot.
I considered selling the device and upgrading to something newer and faster, however at the time of writing, such a thing is completely off the table for obvious reasons. It therefore made sense to upgrade the M700 as much as reasonably possible and continue using it.
Much more recently, however, a new offering in the form of coreboot as an alternative to the stock OEM UEFI has arrived and is mentioned much further along in the thread itself with the usual scant details provided by those who managed to get it working. Coreboot allows for a capable self-compiled bootloader on the M700 without having to resort to weird hacks or hex editing.
Unfortunately, coreboot is no walk in the park, and requires compiling it yourself on another GNU/Linux PC, as well as the extraction of various tidbits from a stock ROM, as well as a fair amount of patience. The documentation is also notoriously awful in many parts and will require you to improvise on numerous occasions. The Gentoo Wiki has some more general instructions that may be helpful.
I still found coreboot a superior experience to CoffeeTime, however, which would fill up my hard drive with a 97 gigabyte text file whenever it ran, and oftentimes refused to run at all.
Assuming you've updated to the latest Lenovo-provided BIOS (FWKTBFA), the first step is to save an image of the stock chip in case something goes wrong and you need to reflash. As mentioned above, I had managed to save a stock image using a CH341 kit from Aliexpress, however switched to pico-serprog upon encountering a situation in which the PC wouldn't boot after using the CH341 until I reseated the CPU.
Apparently one is required to perform a modification to black-boarded programmers or use a level conversion chip, without which the southbridge or whatever else is slowly destroyed by 5v.
After flashing a Pi Pico I had lying around with serprog and wiring it up using the clip that came with the CH341 under the SATA port and taking out the clock battery, reading the image was a matter of running:
flashrom -p serprog:dev=/dev/ttyACM0,spispeed=16M -r stock.rom
flashrom -p serprog:dev=/dev/ttyACM0,spispeed=16M -r stock.romAnd running it a few more times just to be safe, and then verifying it against the chip's contents. If you get a "No flash device found" error, check your wiring using a multimeter in continuity mode and reseat the clip.
Not only is this required in case one must flash back to stock, it'll be required later for coreboot to get the right MAC address and a few other things like that.
After following the tutorial it's best to stop at step 5, before running make menuconfig, as you'll need to extract some files from your stock rom in order to build coreboot.rom. Compiling GCC may also take 20 minutes or more on an anaemic device.
It is also worth installing ccache, and enabling it within coreboot's build options later on if you're planning on trying out different payloads etc as it massively speeds up repeated builds. You may also need to install python-is-python3 on Debian systems plus a few other packages for EDK2 if you decide on that.
Go into the utils folder and compile ifdtool or install the coreboot-utils package and run it against your stock ROM with the -x flag and platform type sklkbl. It'll spit out some "flashregion" files you'll need later. Namely regions 0, 2, and 3.
It is mentioned partway through the original thread that the included Intel VBT in coreboot is quite old for whatever reason, and in my case gave me no display or strange lines when attempting to use EDK2 as a payload. It is best to extract your own VBT from your ROM backup made previously. If you're opting for SeaBIOS or planning to run completely headless you can probably skip this step.
There are a few ways to obtain the VBT, however in the end I used UEFITool's uefiextract on my stock ROM and then did a
grep -rn VBT *
grep -rn VBT *To find the string "VBT". It was in a few different places, but eventually after opening up enough files in a hex editor I was able to extract it. The size of the region to extract is 14 bytes before the start of the string "Intel" and in my case was 3786 bytes along from the start of $VBT.
After pasting it into a new file and saving, it was verified as per this page using intelvbttool and saved as lenovo.vbt.
The newer VBT may be required for later generation CPUs to have any graphical output at all, as any mention of Kaby Lake is absent from the original coreboot-provided one.
For extraction of the old-style video BIOS, there is VBiosFinder that may be run against the Lenovo-provided BIOS update program. I am unsure if it's strictly necessary, however.
Once you've built the toolchain and whatnot for coreboot, it's time to run "make menuconfig" (or xconfig if you've a full desktop) and adjust some settings.
Now you'll have to perform the ever important task of choosing what coreboot actually loads. If your needs are simple or specific, SeaBIOS and/or GRUB will probably work well enough. In my case, I had Windows 10 already installed and wanted to keep booting it, and thus opted for EDK2.
There are two different variants of EDK2; stock and MrChromeBox's fork which contains a few extra features that I personally didn't find to be enough of a drawcard.
I saved the config, exited the config menu, and then ran
make CPUS=12 #or however many cores you have
make CPUS=12 #or however many cores you haveAfter telling me I needed to have nasm and imagmagick installed as well, I eventually got a coreboot.rom in the build folder!
I connected up the Pi Pico to the pins of the Winbond and ran
flashrom -p serprog:dev=/dev/ttyACM0,spispeed=16M -w coreboot.rom
flashrom -p serprog:dev=/dev/ttyACM0,spispeed=16M -w coreboot.romTo flash it to the board. It will automatically check the chip's contents and erase if necessary, then write and verify. After putting the clock battery and drives back in, I finally was able to see an image on the screen, after which it successfully booted. Hurrah!
With coreboot functional with the stock 6500T, it was time to upgrade the CPU. The M700 can accept up to a Coffee Lake 9xxx CPU or equivalent Xeon, or equivalent mutant Chinese monstronsity after being flashed. In my case, I mostly wanted the improved video decode, and opted for a 9100T as it was the cheapest Coffee Lake CPU out there with superior performance. The T in the part name specifies that it has a 35w TDP and thus won't overheat or blow the power supply brick or VRM. Other CPUs may work (some have suggested 45W TDP is just fine), but anything with more than 4 physical cores will require pin-taping which isn't covered here.
I purchased the 9100T from Aliexpress for around $40, and after undoing the 3 fan screws plus the 4 heatsink screws, I pulled the old 6500T out, cleaned off the old paste, applied some new stuff, and chucked it in.
On first boot, there was no display out, however I was able to SSH into it and see that the 9100T was being detected just fine. After a reboot, the display started working with no issue, suggesting that a CMOS reset (with the jumper on and battery out) is probably a good idea after performing the swap.
The 9100T is much faster than the old 6500T in real-world performance, with Linux Mint booting to desktop in about 8 seconds, versus 25 seconds on the 6500T. The only real downside is that as it's so much faster, the fan spins up a lot more while idling around 45 degrees C. If you'd like to experience what a jet engine sounds like, try running Prime 95 with an AVX test for a little while. Apparently there is an upgraded cooler (pn 01ef331) with an extra heat pipe but it's quite expensive.
After flashing coreboot and upgrading to a Coffee Lake 9100T CPU, the M700 Tiny becomes a greatly improved device. Not only is the CPU faster in terms of raw speed, the RAM is also able to run slightly faster (2400 vs 2133) with superior graphics performance as well from the HD 630.
If you have the patience for it, I would highly recommend the upgrade.