---
title: ThinkPad X220 external flashing
x-toc-enable: true
...

NOTE: Separate ROMs build (in the build system) for X220. Make sure
to use the correct one for your laptop.

You can find flashrom under the `flashrom/` directory in the Retroboot source
code release archives. Build it (from source) using the
[Retroboot build instructions page](../git/).

This assumes that you unlocked the regions using ifdtool, and ran me\_cleaner,
when installing Retroboot the first time. Retroboot currently does not provide
pre-compiled utilities, but you can download the source code archive of
Retroboot from the [download page](../../download.md) and build these utilities
using the instructions at [Retroboot build instructions page](../git/).

You do not need to use a flash layout file in flashrom for this, but you can
if you want. This guide assumes that you don't. The only time you really need
one is when you're doing internal flashing, like when updating/changing your
coreboot ROM after already having flashed it externally for the first time.

This guide shows you how to install coreboot (or Retroboot, in this case) onto
an X220 that currently has the Lenovo BIOS firmware on it.

Refer to the [Raspberry Pi page](rpi_setup.md) which tells you how to set up
a Raspberry Pi for SPI flashing. Just buy some 2.54mm or 0.1inch dupont leads
and use those with a test clip for SO8/SOIC8/SO-IC8 chip.

Ideally, if you know how to solder, you should cut the data wires in the middle
(but not power and ground) on the flasher, on the wires from the flasher to the
test clip, strip them, and solder 47ohm resistors. That is, don't use straight
thru wire connection (0ohm) but use 47ohm resistors on the data lines. However,
this isn't strictly required, just recommended. This applies when doing ISP (in
system programming) but isn't really required when flashing new chips that have
not yet been soldered to a mainboard.

Then with your resistors on the data lines, you can insulate using heat shrink
tubing and a hot air jet.

Use of resistors is optional, but highly recommended if you're comfortable
with doing a bit of soldering.

Remove all screws from the bottom of your laptop. Then push the keyboard
forward and lift it out, disconnect it. Remove the palmrest.

Remove all screws from the bottom of your laptop. Then push the keyboard
forward and lift it out, disconnect it. Remove the palmrest.

This photo shows the flash chip (peel back the tape to see it):

![](https://www.coreboot.org/images/thumb/6/62/X220_flashchip.jpg/800px-X220_flashchip.jpg)

NOTE: this image is hotlinked from coreboot.org, for licensing reasons (it is
not clear what license coreboot.org is using), because no X220 was physically
available for the purpose of making this guide. Look at that picture and, note:

* Pin 1 of the chip is nearest to marking that says TP63
* Pin 4 is on right next to where it says TP68 in that photo
* Pin 5 is on the opposite side relative to pin 4
* Pin 8 is on the opposite side relative to pin 1

Here's another illustration of the chip pinout:

    screen on this side
    |5--4|
    |6--3|
    |7--2|
    |8--1|
    speakers on this side

It's 8MiB 25XX NOR flash.

It is assumed that you have the ROM images and me\_cleaner compiled (well,
the me\_cleaner utility is written in Python 3 and does not need to be
compiled). It is also assumed that you have the `cbutils` module compiled.

[If not, build Retroboot using these instructions](../git/)

[Configure a Raspberry Pi for flashing 25XX NOR flash](rpi_setup.md)
(you can use any SPI flasher, but the Raspberry Pi is currently the only SPI
flasher documented on the Retroboot website).

DISCONNECT the charger and battery, so that there is no power supplied to the
X220 mainboard. You will need to fully disassemble your laptop to remove
the mainboard, to access the flash chip. No disassembly instructions are yet
provided on the Retroboot website.

Connect your RPi via SOIC-8 test clip to the X220 flash chip (see above
photo)
and *dump* the firmware. After your clip is connected to a chip (remember,
use external 3.3v from your Raspberry Pi. Pin 1 on the RPi GPIO header is 3.3v
as specified on the RPi guide)

Never connect the clip while 3.3v is live. Only turn on the power after the
clip is connected, to reduce the chance of shorting/frying anything by mistake.

Ideally, your data lines (from RPi to test clip) should have 47ohm resistors
on them (manufacturers recommend this when doing ISP, short for In System
Programming. it's when you flash a chip that's already mounted to a mainboard
which is exactly what you're doing in this case).

On your Raspberry Pi, it is assumed that you're running Raspbian. In Raspbian
you can just do `sudo raspi-config` and enable SPI in there.

Assuming you've got your RPi wired correctly, your clip correctly connected
and 3.3v is active on the VCC pins of the flash chips, you should be able to
flashrom.

Do not flash yet. First, you should make a full backup of the chip:.

    sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -r 8mb_dump.bin

Make several dumps, and compare them in `sha512sum`. If the dumps all have the
same checksum, then they are good dumps.

This is flashrom running on your Raspberry Pi, which you SSH'd into. You can
actually download Retroboot (from Git) on your Raspberry Pi, and [build flashrom
using the instructions on the Retroboot website](../git/)

If flashrom complains about multiple detected flashchips, per definitions,
just do what it says and pick one using `-c` option. If it fails, pick another
one. Make sure to get a good dump.

If these are successful, you'll see these files created. Take several of these
and compare in `sha512sum` to verify the hashes; if you dump a ROM with the
same checksum several times, then it's very likely a good dump.

Keep these dumps safe, backed up in several places on several storage mediums.
You might need them at some point in the future.

Now, please note: the first 5MiB of the dump you made contains descriptor, ME
and GbE. You need these!

Extract the 5MiB region (final 3MiB part is BIOS region):

    dd if=8mb_dump of=5mb.bin bs=5M count=1

The file `8mb_dump` above is the full backup you made of the flash contents.

Retroboot distributes 8MiB ROM images, for just the BIOS region in the upper
3MiB of the chip on your X220. You should join the 5MiB file from above with
the upper 3MiB of your retroboot ROM. However, before you do so:

    ./meclean 5mb.bin

Then your file will be under `bin/neutered/` in the Retroboot build system.
Now use ifdtool to set all regions read-write (this makes internal re-flashing
much easier later on). Like so (ifdtool built in the Retroboot build system):

    ./coreboot/x230_4mb/util/ifdtool/ifdtool --unlock ./bin/neutered/5mb.bin.neutered

The above commands are from the Retroboot build system, and assume you've
build the `cbutils` and `me_cleaner` modules. It is strongly recommended that
you run `me_cleaner` and unlock your descriptor+ME region using ifdtool, as
above.

When you run the `ifdtool` command, you'll have a new file
named `5mb.bin.neutered.new`

Now, take your 8MiB ROM from Retroboot and insert the 5MiB file containing
your neutered Intel ME with unlocked IFD regions:

    dd if=5mb.bin.neutered.new of=8mb.x220.retroboot.rom bs=5M count=1 conv=notrunc

Previously, the first 5MiB of the Retroboot ROM was just 0xFF padding but now
it should contain your descriptor, GbE and Intel ME. The ROM is now ready to
flash on your machine.

In the above example, `5mb.bin.neutered.new` is the first 5MiB of the dump
from your X220 (prior to flashing), run through `me_cleaner` and then run
through `ifdtool --unlock`; combined, these two tasks neutered the Intel ME
and set all regions read-write in the flash. The `8mb.x220.retroboot.rom` file
in the above example is simply a 8MiB X220 ROM (of your choice) from
Retroboot, either in a release or compiled by you from the source code.

Now flash Retroboot (8MiB image). We will use the ROM images prepared above.
Like so (Raspberry Pi was used, when writing this guide):

    sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -w 8mb.x220.retroboot.rom

Ditto about multiple flashchip definitions thing. Use `-c` option if flashrom
tells you to. When you've successfully flashed.

If successful, flashrom will say `VERIFIED` after you've finished flashing.

If you're not successful, check RPi wiring and check you're connecting the clip
the right way round. Also, check the software configuration on your RPi.

If you still can't get it working, check the voltage again on the flash chip
vcc pins. Ensure that you are correctly providing 3.3v to pin 8 of the flash
chip.
