retroboot/docs/install/x230_external.md

---

title: ThinkPad X230/X230T external flashing x-toc-enable: true ...

Retroboot provides separate ROM images for X230 and X230 Tablet. The instructions are identical, except for the exact ROM image(s) that you will use.

Retroboot provides 4MiB and 12MiB ROM images for the X230/X230T. The Intel Flash Descriptor defines that the first 5MiB of the 12MiB boot flash consists of the Intel Flash Descriptor, GbE and Intel ME regions. The final 7MiB of that 12MiB flash is the BIOS region. However, this 12MiB of flash is physically split into an 8MiB NOR flash and a 4MiB NOR flash; the OS sees a continuous 12MiB of flash, with the lower part being the contents of 8MiB NOR flash and the upper contents being the 4MiB NOR flash.

Due to this physical configuration, the 4MiB ROM image from Retroboot is recommended. It really is a 4MiB ROM image. The 12MiB ROM image (named 7mb in the ROM because it's 7MiB CBFS for the full 7MiB BIOS region) is only recommended for internal flashing, after external flashing using this guide.

Because of this physical configuration, we recommend to flash the 4MiB ROM when installing Retroboot externally the first time. However, the write protections set by Lenovo BIOS no longer exist when you boot Retroboot. Therefore, after you installed the 4MiB ROM the first time, you can flash the 12MiB ROM. This entire document assumes that you are flashing the 4MiB image; separate instructions are available on the main install page for how to handle the 7MiB ROM image.

You can find flashrom under the flashrom/ directory in the Retroboot source code release archives. Build it (from source) using the Retroboot build instructions page.

This assumes that you unlocked the regions using ifdtool, and ran me_cleaner, when installing Retroboot the first time. Retroboot currently does not provide pre-compiled utilities, but you can download the source code archive of Retroboot from the download page and build these utilities using the instructions at Retroboot build instructions page.

You do not need to use a flash layout file in flashrom for this, but you can if you want. This guide assumes that you don't. The only time you really need one is when you're doing internal flashing, like when updating/changing your coreboot ROM after already having flashed it externally for the first time.

This guide shows you how to install coreboot (or Retroboot, in this case) onto an X230 that currently has the Lenovo BIOS firmware on it.

Refer to the Raspberry Pi page which tells you how to set up a Raspberry Pi for SPI flashing. Just buy some 2.54mm or 0.1inch dupont leads and use those with a test clip for SO8/SOIC8/SO-IC8 chip.

Ideally, if you know how to solder, you should cut the data wires in the middle (but not power and ground) on the flasher, on the wires from the flasher to the test clip, strip them, and solder 47ohm resistors. That is, don't use straight thru wire connection (0ohm) but use 47ohm resistors on the data lines. However, this isn't strictly required, just recommended. This applies when doing ISP (in system programming) but isn't really required when flashing new chips that have not yet been soldered to a mainboard.

Then with your resistors on the data lines, you can insulate using heat shrink tubing and a hot air jet.

Use of resistors is optional, but highly recommended if you're comfortable with doing a bit of soldering.

Remove all screws from the bottom of your laptop. Then push the keyboard forward and lift it out, disconnect it.

CAREFULLY remove the locking tab for the touchpad from the palmrest. It's in a locking tab, with you can carefully open, like a door. Then carefully remove the palmrest. Emphasis on the word carefully because those locking tabs are very easy to break!

This photo shows the flash chips:

The flash chip on the right is 8MiB SO-IC8 25XX NOR flash. It contains the Intel Flash Descriptor, Intel ME and GbE regions.

The flash chip on the left is 4MiB and contains the BIOS region. By default, Lenovo BIOS is flashed here but you can flash coreboot (or in this case, Retroboot).

It is assumed that you have the ROM images and me_cleaner compiled (well, the me_cleaner utility is written in Python 3 and does not need to be compiled). It is also assumed that you have the cbutils module compiled.

If not, build Retroboot using these instructions

Configure a Raspberry Pi for flashing 25XX NOR flash (you can use any SPI flasher, but the Raspberry Pi is currently the only SPI flasher documented on the Retroboot website).

The pin numbers shown in the above photo correspond to the pinout on the RPi page for SOIC-8. HOWEVER, do NOT use 3.3v power rail either from your RPi or any other external source.

For 3.3v power to the flash chips, do this:

• With Lenovo BIOS present, go to Setup
• Enable Wake on LAN

Now turn off the laptop, with an LAN cable inserted into the RJ45 jack. DISCONNECT the charger and battery, so that there is no power supplied to the X230 mainboard.

Connect your RPi via SOIC-8 test clip to the X230 flash chips (both of them) and dump the firmware. After your clip is connected to a chip (remember, DO NOT use external 3.3v from your Raspberry Pi. Pin 1 on the RPi GPIO header is 3.3v as specified on the RPi guide, but do not connect it!)

Ideally, your data lines (from RPi to test clip) should have 47ohm resistors on them (manufacturers recommend this when doing ISP, short for In System Programming. it's when you flash a chip that's already mounted to a mainboard which is exactly what you're doing in this case).

Connect your test clip, then insert the LAN cable and the charger plug into the laptop (but NOT the battery). If Wake on LAN is working, the Intel NIC will now be live, waiting for a magic packet), but do not send a magic packet and do not power on the board. If the Intel NIC's LED is lit up on the RJ45 jack, this most likely means that the 3.3v power rail is active, which is also connected to the VCC pins on the flash chips.

If you want to test this, you can use a multi-meter before you connect your clip. Pin 8 (see photo above) on each chip is VCC (3.3v) and pin 4 is GND (ground). Set your DMM (digital multi meter) to volt meter (DC) mode and touch the black probe to pin 4, and then touch the red probe to pin 8. Be careful not to short anything when doing this, because there is a 3.3v power rail active. The tolerance for 3.3v NOR flash is actually 2.7 to 3.6v on most chips; when Leah tested this on an X230, it read 3.4v, which is fine.

On your Raspberry Pi, it is assumed that you're running Raspbian. In Raspbian you can just do sudo raspi-config and enable SPI in there.

Assuming you've got your RPi wired correctly, your clip correctly connected and 3.3v is active on the VCC pins of the flash chips, you should be able to flashrom.

Do not flash yet. First, you should make a full backup of both chips.

4MiB chip (on the left, in the photo above) containing the BIOS region:

`sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -r 4mb_dump.bin`

8MiB chip (on the right, in the photo above) containing the Intel Flash Descriptor, GbE and Intel ME regions:

`sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -r 8mb_dump.bin`

This is flashrom running on your Raspberry Pi, which you SSH'd into. You can actually download Retroboot (from Git) on your Raspberry Pi, and build flashrom using the instructions on the Retroboot website

If flashrom complains about multiple detected flashchips, per definitions, just do what it says and pick one using -c option. If it fails, pick another one. Make sure to get a good dump.

If these are successful, you'll see these files created. Take several of these and compare in sha512sum to verify the hashes; if you dump a ROM with the same checksum several times, then it's very likely a good dump.

Keep these dumps safe, backed up in several places on several storage mediums. You might need them at some point in the future.

Now flash Retroboot (4MiB image) to the chip on the left, in the photo above. This is the chip for the BIOS region. Like so:

`sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -w retroboot.rom`

Ditto about multiple flashchip definitions thing. Use -c option if flashrom tells you to. When you've successfully flashed.

On your 8MiB dump, containing Intel ME, GbE and Intel Flash Descriptor, run me_cleaner. Retroboot includes, in the Git repository, a script called meclean. Download me_cleaner by running ./download me_cleaner in the Retroboot build system.

The meclean script just calls me_cleaner but makes things simpler because you just specify a ROM file name/path. Specify the path to your 8MiB dump. E.g.

`./meclean 8mb_dump.bin`

Path can be relative to meclean script, when running from the root of the Retroboot repository, or it can be an absolute file path.

The neutered Intel ME firmware (with descriptor and GbE intact, and only minor changes to the Intel Flash Descriptor) will be stored under bin/neutered/ and in fact the script will tell you the exact path where it the neutered version was saved to.

Optionally, you can set the regions read-write. Regardless of me_cleaner, the default descriptor on X230 sets some regions of the flash chip read-only. This means that updating/switching the ROMs later on is harder. It is highly recommended that you do this, using ifdtool. Build cbutils module in Retroboot by running ./build module cbutils in the Retroboot build system after running ./download coreboot and an ifdtool executable will be located in coreboot/x230_4mb/util/ifdtool/ in the Retroboot repository.

Run the following ifdtool command on your neutered descriptor+ME+GbE ROM:

`ifdtool --unlock neutered.rom`

The ifdtool will then create a new file, named neutered.rom.new

In this modified file, the descriptor and ME regions are set read-write.

Flash neutered.rom.new to the flash chip on the right in the above photo. Like so:

`sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=32768 -w neutered.rom.new`

Again, ditto about -c option in flashrom. If it complains, just do what it says.

For both flashes (to 4MiB chip and 8MiB chip) you know that it was successful if flashrom says VERIFIED at the end. At this point, try to boot your system!

If you're not successful, check RPi wiring and check you're connecting the clip the right way round. Also, check the software configuration on your RPi.

If you still can't get it working, check the voltage again on the flash chip vcc pins. Sometimes the WoL method is unreliable. If that is the case, disconnect everything then plug the charger in, power on the laptop to make sure it still works and, without a battery connected, yank out the power cord to power down the laptop.

5MiB Descriptor+GbE+ME region

In the above steps, you were told to run me_cleaner and ifdtool on the dumped contents of the 8MiB NOR flash. In reality, this tool is only doing stuff on the first 5MiB of that dump, because that's where those regions live. The upper 3MiB of that 8MiB dump is actually the lower 3MiB of the BIOS region, where the upper 4MiB of that region is physically flashed onto the separate 4MiB NOR flash.

For simplicity, this guide told you to re-flash the 8MiB dump after running me_cleaner and ifdtool on it, and then flash the 4MiB X230 ROM (from Retroboot) onto the 4MiB NOR flash. This means that there is 3MiB of unused space in the lower 3MiB of the NOR flash.

Technically, this means that code from the Lenovo BIOS could still be there. It will never be executed by coreboot, so it's just sitting there unused.

After you have followed this guide, and successfully booted your X230, using the 4MiB X230 ROM, we recommend:

• Re-assemble your X230.
• Boot a GNU+Linux distro on it
• Install flashrom on it
• Re-flash with the 12MiB X230 ROM (from Retroboot), but only flash the upper 7MiB of it tothe upper 12MiB of the boot flash. When your X230 is booted, flashrom doesn't see two flash chips (8MiB and 4MiB), just one full 12MiB of flash, where the upper part is your 4MiB chip.

Basically, re-flash from your GNU+Linux distro. Software-based flashing was not possible with Lenovo BIOS, because it sets PRx registers in such a way as to block flashes. Retroboot does not, so you can now re-flash from your OS without having to disassemble your X230 or use any external flashing hardware.

Precise instructions are available on the main installation guide

External +3.3v

This is not recommended, because there are some reports of users permanently destroying their X230 this way. However, that might be because they used a CH341A or something (5V data lines) or just a really dodgy power supply, or in general a really unstable supply, or they managed to short something. For example, said person might have activated +3.3v before connecting the clip (you should always leave +3.3v disconnected / disabled until you connect the clip and ensure that it is connected properly) and that person fried something.

We simply don't know, because the coreboot documentation just says don't do that without going into much detail. We've been using external power on laptops for a long time, without any real issues, when doing ISP.

If you can't get power reliably on the chips when using the WoL method, then wire up +3.3v from pin 1 on the GPIO header of your RPi, to the pin on the clip connecting to pin 8 on the flash chip.

Be advised that this is a very non-standard thing to do, because those vcc pins on the flash chips are connected to many other places on the X230 mainboard so you will in fact be powering many other parts of the X230 mainboard. Simply speaking, the board is not designed to be powered in that way. As long as you're using a stable power supply (RPi power supply is pretty stable and you can check it on a multi-meter) you should be fine. However, if you have decent electronics knowledge and soldering skills, what you could do to make this much safer is:

• Cut the VCC lines so that pin 8 on both flash chips are isolated
• Jump the cut using a diode. This will block external power from your SPI flasher from power anything except each flash chip (each flash chip should also be isolated)
• X230 mainboard was designed by the ODM named Wistron and the codename for the board is Dasher-2. Look up Dasher-2 board schematics online, at websites such as chinafix or just use baidu (or hell, sometimes google will even show results). Look for schematics, but the boardview will give you a visual view of the actual board itself, based on those schematics; you can view boardviews in a piece of free software called openboardview

If you do that, and use 47ohm resistors on the wires from SPI flasher to test clip, you should be relatively safe (again, be careful not to short anything and make sure to connect your test clip the right way round. These flash chips are quite bullet proof, but your X230 mainboard isn't ;)