---
title: ThinkPad X230/X230T external flashing
x-toc-enable: true
...

Retroboot provides separate ROM images for X230 and X230 Tablet. The instructions
are identical, except for the exact ROM image(s) that you will use.

Retroboot provides 4MiB and 12MiB ROM images for the X230/X230T. The Intel Flash
Descriptor defines that the first 5MiB of the 12MiB boot flash consists of
the Intel Flash Descriptor, GbE and Intel ME regions. The final 7MiB of that
12MiB flash is the BIOS region. However, this 12MiB of flash is physically split
into an 8MiB NOR flash and a 4MiB NOR flash; the OS sees a continuous 12MiB of
flash, with the lower part being the contents of 8MiB NOR flash and the upper
contents being the 4MiB NOR flash.

Due to this physical configuration, the 4MiB ROM image from Retroboot is
recommended. It really is a 4MiB ROM image. The 12MiB ROM image (named `7mb`
in the ROM because it's 7MiB CBFS for the full 7MiB BIOS region) is only
recommended for internal flashing, *after* external flashing using this guide.

Because of this physical configuration, we recommend to flash the 4MiB ROM when
installing Retroboot externally the first time. However, the write protections
set by Lenovo BIOS no longer exist when you boot Retroboot. Therefore, after
you installed the 4MiB ROM the first time, you can flash the 12MiB ROM. This
entire document assumes that you are flashing the 4MiB image; separate
instructions are available on [the main install page](index.md#x230) for how
to handle the 7MiB ROM image.

You can find flashrom under the `flashrom/` directory in the Retroboot source
code release archives. Build it (from source) using the
[Retroboot build instructions page](../git/).

This assumes that you unlocked the regions using ifdtool, and ran me\_cleaner,
when installing Retroboot the first time. Retroboot currently does not provide
pre-compiled utilities, but you can download the source code archive of
Retroboot from the [download page](../../download.md) and build these utilities
using the instructions at [Retroboot build instructions page](../git/).

You do not need to use a flash layout file in flashrom for this, but you can
if you want. This guide assumes that you don't. The only time you really need
one is when you're doing internal flashing, like when updating/changing your
coreboot ROM after already having flashed it externally for the first time.

This guide shows you how to install coreboot (or Retroboot, in this case) onto
an X230 that currently has the Lenovo BIOS firmware on it.

Refer to the [Raspberry Pi page](rpi_setup.md) which tells you how to set up
a Raspberry Pi for SPI flashing. Just buy some 2.54mm or 0.1inch dupont leads
and use those with a test clip for SO8/SOIC8/SO-IC8 chip.

Ideally, if you know how to solder, you should cut the data wires in the middle
(but not power and ground) on the flasher, on the wires from the flasher to the
test clip, strip them, and solder 47ohm resistors. That is, don't use straight
thru wire connection (0ohm) but use 47ohm resistors on the data lines. However,
this isn't strictly required, just recommended. This applies when doing ISP (in
system programming) but isn't really required when flashing new chips that have
not yet been soldered to a mainboard.

Then with your resistors on the data lines, you can insulate using heat shrink
tubing and a hot air jet.

Use of resistors is optional, but highly recommended if you're comfortable
with doing a bit of soldering.

Remove all screws from the bottom of your laptop. Then push the keyboard
forward and lift it out, disconnect it.

CAREFULLY remove the locking tab for the touchpad from the palmrest. It's in
a locking tab, with you can carefully open, like a door. Then carefully remove
the palmrest. Emphasis on the word *carefully* because those locking tabs are
very easy to break!

This photo shows the flash chips:

![](images/x230/kaptontape.jpg)

The flash chip on the right is 8MiB SO-IC8 25XX NOR flash. It contains the
Intel Flash Descriptor, Intel ME and GbE regions.

The flash chip on the left is 4MiB and contains the BIOS region. By default,
Lenovo BIOS is flashed here but you can flash coreboot (or in this case,
Retroboot).

It is assumed that you have the ROM images and me\_cleaner compiled (well,
the me\_cleaner utility is written in Python 3 and does not need to be
compiled). It is also assumed that you have the `cbutils` module compiled.

[If not, build Retroboot using these instructions](../git/)

[Configure a Raspberry Pi for flashing 25XX NOR flash](rpi_setup.md)
(you can use any SPI flasher, but the Raspberry Pi is currently the only SPI
flasher documented on the Retroboot website).

The pin numbers shown in the above photo correspond to the pinout on the RPi
page for SOIC-8. HOWEVER, do NOT use 3.3v power rail either from your RPi or
any other external source.

For 3.3v power to the flash chips, do this:

* With Lenovo BIOS present, go to Setup
* Enable `Wake on LAN`

Now turn off the laptop, with an LAN cable inserted into the RJ45 jack.
DISCONNECT the charger and battery, so that there is no power supplied to the
X230 mainboard.

Connect your RPi via SOIC-8 test clip to the X230 flash chips (both of them)
and *dump* the firmware. After your clip is connected to a chip (remember, DO
NOT use external 3.3v from your Raspberry Pi. Pin 1 on the RPi GPIO header is
3.3v as specified on the RPi guide, but do not connect it!)

Ideally, your data lines (from RPi to test clip) should have 47ohm resistors
on them (manufacturers recommend this when doing ISP, short for In System
Programming. it's when you flash a chip that's already mounted to a mainboard
which is exactly what you're doing in this case).

Connect your test clip, then insert the LAN cable and the charger plug into
the laptop (but NOT the battery). If Wake on LAN is working, the Intel NIC will
now be live, waiting for a *magic packet*), but do not send a magic packet and
do not power on the board. If the Intel NIC's LED is lit up on the RJ45 jack,
this most likely means that the 3.3v power rail is active, which is also
connected to the VCC pins on the flash chips.

If you want to test this, you can use a multi-meter before you connect your
clip. Pin 8 (see photo above) on each chip is VCC (3.3v) and pin 4 is GND
(ground). Set your DMM (digital multi meter) to volt meter (DC) mode and touch
the black probe to pin 4, and then touch the red probe to pin 8. Be *careful*
not to short anything when doing this, because there is a 3.3v power rail
active. The tolerance for 3.3v NOR flash is actually 2.7 to 3.6v on most chips;
when Leah tested this on an X230, it read 3.4v, which is fine.

On your Raspberry Pi, it is assumed that you're running Raspbian. In Raspbian
you can just do `sudo raspi-config` and enable SPI in there.

Assuming you've got your RPi wired correctly, your clip correctly connected
and 3.3v is active on the VCC pins of the flash chips, you should be able to
flashrom.

Do not flash yet. First, you should make a full backup of both chips.

4MiB chip (on the left, in the photo above) containing the BIOS region:

    `sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -r 4mb_dump.bin`

8MiB chip (on the right, in the photo above) containing the Intel Flash
Descriptor, GbE and Intel ME regions:

    `sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -r 8mb_dump.bin`

This is flashrom running on your Raspberry Pi, which you SSH'd into. You can
actually download Retroboot (from Git) on your Raspberry Pi, and [build flashrom
using the instructions on the Retroboot website](../git/)

If flashrom complains about multiple detected flashchips, per definitions,
just do what it says and pick one using `-c` option. If it fails, pick another
one. Make sure to get a good dump.

If these are successful, you'll see these files created. Take several of these
and compare in `sha512sum` to verify the hashes; if you dump a ROM with the
same checksum several times, then it's very likely a good dump.

Keep these dumps safe, backed up in several places on several storage mediums.
You might need them at some point in the future.

Now flash Retroboot (4MiB image) to the chip on the left, in the photo above.
This is the chip for the BIOS region. Like so:

    `sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -w retroboot.rom`

Ditto about multiple flashchip definitions thing. Use `-c` option if flashrom
tells you to. When you've successfully flashed.

On your 8MiB dump, containing Intel ME, GbE and Intel Flash Descriptor, run
me\_cleaner. Retroboot includes, in the Git repository, a script called
`meclean`. Download me\_cleaner by running `./download me_cleaner` in the
Retroboot build system.

The meclean script just calls me\_cleaner but makes things simpler because
you just specify a ROM file name/path. Specify the path to your 8MiB dump. E.g.

    `./meclean 8mb_dump.bin`

Path can be relative to meclean script, when running from the root of the
Retroboot repository, or it can be an absolute file path.

The neutered Intel ME firmware (with descriptor and GbE intact, and only minor
changes to the Intel Flash Descriptor) will be stored under `bin/neutered/` and
in fact the script will tell you the exact path where it the neutered version
was saved to.

Optionally, you can set the regions read-write. Regardless of me\_cleaner, the
default descriptor on X230 sets some regions of the flash chip read-only. This
means that updating/switching the ROMs later on is harder. It is highly
recommended that you do this, using `ifdtool`. Build `cbutils` module in
Retroboot by running `./build module cbutils` in the Retroboot build system
after running `./download coreboot` and an `ifdtool` executable will be located
in `coreboot/x230_4mb/util/ifdtool/` in the Retroboot repository.

Run the following ifdtool command on your neutered descriptor+ME+GbE ROM:

    `ifdtool --unlock neutered.rom`

The `ifdtool` will then create a new file, named `neutered.rom.new`

In this modified file, the descriptor and ME regions are set read-write.

Flash neutered.rom.new to the flash chip on the right in
the above photo. Like so:

    `sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -w neutered.rom.new`

Again, ditto about `-c` option in flashrom. If it complains, just do what it says.

For both flashes (to 4MiB chip and 8MiB chip) you know that it was successful
if flashrom says `VERIFIED` at the end. At this point, try to boot your system!

If you're not successful, check RPi wiring and check you're connecting the clip
the right way round. Also, check the software configuration on your RPi.

If you still can't get it working, check the voltage again on the flash chip
vcc pins. Sometimes the WoL method is unreliable. If that is the case,
disconnect *everything* then plug the charger in, power on the laptop to make
sure it still works and, without a battery connected, yank out the power cord
to power down the laptop.

5MiB Descriptor+GbE+ME region
-----------------------------

In the above steps, you were told to run me\_cleaner and ifdtool on the dumped
contents of the 8MiB NOR flash. In reality, this tool is only doing stuff on
the first 5MiB of that dump, because that's where those regions live. The upper
3MiB of that 8MiB dump is actually the lower 3MiB of the BIOS region, where the
upper 4MiB of that region is physically flashed onto the separate 4MiB NOR flash.

For simplicity, this guide told you to re-flash the 8MiB dump after running
me\_cleaner and ifdtool on it, and then flash the 4MiB X230 ROM (from Retroboot)
onto the 4MiB NOR flash. This means that there is 3MiB of unused space in the
lower 3MiB of the NOR flash.

Technically, this means that code from the Lenovo BIOS could still be there. It
will never be executed by coreboot, so it's just sitting there unused.

After you have followed this guide, and successfully booted your X230, using
the 4MiB X230 ROM, we recommend:

* Re-assemble your X230.
* Boot a GNU+Linux distro on it
* Install `flashrom` on it
* Re-flash with the 12MiB X230 ROM (from Retroboot), but only flash the upper
  7MiB of it tothe upper 12MiB of the boot flash. When your X230 is booted,
  flashrom doesn't see two flash chips (8MiB and 4MiB), just one full 12MiB
  of flash, where the upper part is your 4MiB chip.

Basically, re-flash from your GNU+Linux distro. Software-based flashing was
not possible with Lenovo BIOS, because it sets PRx registers in such a way as
to block flashes. Retroboot does not, so you can now re-flash from your OS
without having to disassemble your X230 or use any external flashing hardware.

Precise instructions are available on the [main installation guide](index.md#x230)

External +3.3v
--------------

This is not recommended, because there are some reports of users permanently
destroying their X230 this way. However, that might be because they used a
CH341A or something (5V data lines) or just a really dodgy power supply, or
in general a really unstable supply, or they managed to short something. For
example, said person might have activated +3.3v before connecting the clip (you
should always leave +3.3v disconnected / disabled until you connect the clip
and ensure that it is connected properly) and that person fried something.

We simply don't know, because the coreboot documentation just says *don't do
that* without going into much detail. We've been using external power on laptops
for a long time, without any real issues, when doing ISP.

If you can't get power reliably on the chips when using the WoL method, then
wire up +3.3v from pin 1 on the GPIO header of your RPi, to the pin on the clip
connecting to pin 8 on the flash chip.

Be advised that this is a very non-standard thing to do, because those vcc pins
on the flash chips are connected to many other places on the X230 mainboard
so you will in fact be powering many other parts of the X230 mainboard. Simply
speaking, the board is not designed to be powered in that way. As long
as you're using a stable power supply (RPi power supply is pretty stable and you
can check it on a multi-meter) you should be fine. However, if you have decent
electronics knowledge and soldering skills, what you could do to make this much
safer is:

* Cut the VCC lines so that pin 8 on both flash chips are isolated
* Jump the cut using a diode. This will block external power from your SPI
  flasher from power anything except each flash chip (each flash chip should
  also be isolated)
* X230 mainboard was designed by the ODM named *Wistron* and the codename for
  the board is Dasher-2. Look up Dasher-2 board schematics online, at websites
  such as chinafix or just use baidu (or hell, sometimes google will even
  show results). Look for schematics, but the boardview will give you a visual
  view of the actual board itself, based on those schematics; you can view
  boardviews in a piece of free software called `openboardview`

If you do that, and use 47ohm resistors on the wires from SPI flasher to test
clip, you should be relatively safe (again, be careful not to short anything
and make sure to connect your test clip the right way round. These flash chips
are quite bullet proof, but your X230 mainboard isn't ;)
